This vulnerability (CWE-770) in Kibana involves allocation of resources without limits or throttling, which can be triggered by an authenticated user authorized to manage maintenance windows. The attacker submits a malformed payload that causes excessive resource consumption in the Kibana process, leading to denial of service. The service becomes unresponsive for all users and does not recover automatically. The vulnerability affects Kibana versions 8.12.0, 9.0.0, and 9.4.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with authenticated access and maintenance window management permissions can cause Kibana to consume excessive resources, resulting in denial of service for all users. This impacts availability but does not affect confidentiality or integrity. The service requires manual intervention to recover from the condition.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to maintenance window management privileges to trusted users only and monitor for unusual resource consumption patterns. No official fix or temporary workaround has been published by the vendor at this time.