This vulnerability (CWE-407) in Kibana arises from inefficient algorithmic complexity when processing specially crafted, deeply nested expressions in TSVB visualizations. The evaluation runs synchronously and its computational cost grows disproportionately with input size, leading to a denial of service condition by blocking the request-processing thread indefinitely. No known exploits are reported in the wild, and no official remediation or patch has been published by Elastic as of the data provided.

An attacker with at least low privileges can submit a crafted request that causes Kibana to become unresponsive by exhausting the request-processing thread. This results in denial of service, preventing legitimate users from accessing Kibana until the service is restarted. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to Kibana TSVB visualization inputs to trusted users and monitor for unusual request patterns that could indicate exploitation attempts.