This vulnerability (CWE-770) in Kibana allows an authenticated user with read-only access to the alerting feature to trigger excessive resource allocation by submitting a specially crafted malformed payload. This causes the Kibana process to consume excessive resources, resulting in denial of service (CAPEC-130). A single request can render Kibana unable to serve any requests until the process is restarted. The affected versions explicitly identified are 8.0.0 and 9.0.0. No official patch or remediation level has been published by Elastic as of the data provided.

The impact is denial of service due to excessive resource consumption by the Kibana process. This prevents all users from accessing Kibana until the process is manually restarted. There is no impact on confidentiality or integrity reported. The vulnerability requires authentication with read-only privileges to the alerting feature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual resource consumption and consider restricting alerting feature access to trusted users only. Restarting the Kibana process restores service after an attack. No official fix or temporary mitigation has been published by Elastic at this time.