Denial of Service Vulnerability in Kibana by Elastic

CVE-2026-42399

What is CVE-2026-42399?

An authenticated low-privileged user in Kibana can exploit a vulnerability that allows them to submit a specially crafted Timelion visualization expression. This expression, containing deeply chained function calls, can cause Kibana to consume large amounts of memory. As the data structure grows uncontrollably, it can lead to memory exhaustion, ultimately resulting in a denial of service where the Kibana service crashes and becomes unavailable for all users.

References