Threats Tagged 'bit-elk-2026-72663'

CVE-2026-72663 is a vulnerability in Kibana where inefficient algorithmic complexity in processing deeply nested expressions in TSVB visualizations can cause denial of service. A crafted input causes synchronous evaluation that consumes the request-processing thread indefinitely, making Kibana unresponsive until restarted. This affects Kibana versions from 8.0.0 up to but not including 8.19.20 and from 9.0.0 up to but not including 9.4.5. A patch is available to address this issue. No known exploits are reported in the wild.

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.