CVE-2026-63260: 
Kibana vulnerability analysis and mitigation

CVE-2026-63260 is an Uncontrolled Resource Consumption (CWE-400) vulnerability in Elastic Kibana that can lead to denial of service via excessive memory allocation (CAPEC-130). An authenticated attacker with low-privilege access can crash the Kibana process by sending a specially crafted, oversized request payload that exhausts available heap memory. Affected versions include Kibana 8.0.0–8.19.18, 9.0.0–9.3.7, and 9.4.0–9.4.3. It was published on July 21, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Elastic Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption): Kibana fails to enforce adequate size limits on incoming request payloads, allowing user-supplied input to trigger resource-intensive heap memory allocation. An authenticated attacker with low privileges can send an oversized HTTP request to a vulnerable Kibana endpoint; processing this payload causes excessive memory allocation that exhausts the Kibana process's heap, resulting in a crash. No user interaction is required beyond authentication, and the attack is conducted over the network with low complexity. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, Elastic Advisory).

Successful exploitation results in a complete loss of availability for the Kibana service — the process crashes and becomes unavailable to all users, not just the attacker. There is no impact on confidentiality or data integrity, as the attack is purely a denial-of-service condition. In environments where Kibana is used for security monitoring or operational dashboards, an outage could impair visibility into infrastructure and delay incident response (GitHub Advisory, Elastic Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for authenticated (low-privilege) access. The EPSS score is approximately 0.235%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Elastic Advisory).

• Network: Unusually large HTTP request payloads sent to Kibana API endpoints from authenticated low-privilege accounts; repeated requests from the same source IP targeting Kibana.
• Logs: Kibana process crash logs or out-of-memory (OOM) errors in Kibana application logs; Node.js heap allocation failure messages (e.g., FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory).
• Process: Unexpected Kibana process restarts or crashes; elevated heap memory usage visible in Kibana monitoring dashboards prior to crash.
• System: Operating system OOM killer events targeting the Kibana process in system logs (e.g., /var/log/syslog or journalctl entries referencing kibana being killed).

Elastic has released patched versions: 8.19.19, 9.3.8, and 9.4.4. Users should upgrade to one of these versions as the primary remediation (Elastic Advisory). As interim mitigations, administrators should consider implementing request size limits at the reverse proxy or load balancer layer, applying rate limiting on Kibana endpoints, and configuring JVM/Node.js heap memory limits with alerting for unusual consumption patterns. Restricting Kibana access to trusted, authenticated users and networks reduces the attack surface.

Elastic published an official security advisory (ESA-2026-71) covering this and related vulnerabilities in the Kibana 8.19.19, 9.3.8, and 9.4.4 releases (Elastic Advisory). Tenable released detection plugins for the vulnerability, and third-party security advisories were published by INCIBE and NetEye. Community reaction has been limited given the moderate severity and lack of active exploitation.