This vulnerability (CWE-400) in Kibana allows an authenticated user with low privileges to exploit uncontrolled resource consumption via specially crafted requests to the Canvas feature. The excessive allocation of resources causes the Kibana server process to crash, resulting in denial of service (DoS) for all users relying on that Kibana instance. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

An attacker with low-privileged authenticated access can cause the Kibana server process to terminate, leading to denial of service for all users of that Kibana instance. There is no impact on confidentiality or integrity, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, monitor vendor communications for updates. In the meantime, restrict authenticated access to trusted users and consider limiting access to the Canvas functionality if possible.