CVE-2026-72663
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Kibana has an inefficient algorithmic complexity vulnerability (CWE-407) leading to denial of service via input data manipulation. A specially crafted, deeply nested expression submitted to a TSVB visualization is evaluated with worst-case cost growing disproportionately with input size. Because evaluation runs synchronously, a single request consumes the request-processing thread indefinitely, and Kibana stops responding until restart.
Risk Assessment
The attack can completely block request processing in Kibana, causing service unavailability for all users. A single request is sufficient.
Recommendation
Install the Kibana update with the fix. Restrict access to TSVB visualizations and monitor thread usage.
Original NVD description (English source)
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.