This vulnerability (CWE-770) in Kibana allows an authenticated low-privileged user to submit a malformed payload to a visualization feature that is not properly validated. Processing this payload causes unbounded memory allocation in the Kibana process, which eventually exhausts system memory and causes the process to be terminated by the host. This results in a denial of service condition where Kibana becomes unavailable until manually restarted. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Successful exploitation results in denial of service by exhausting system memory, causing the Kibana process to terminate and become unavailable to all users until the service is restarted. There is no direct confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, restrict access to Kibana visualization features to trusted users and monitor for abnormal memory usage patterns.