CVE-2026-72674 | BDVDB-2026-359019 Detail

Description#

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-13Record published in the CVE List.