CVE-2026-63260: Kibana Denial of Service Vulnerability

CVE-2026-63260 Overview

CVE-2026-63260 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in Elastic Kibana. An authenticated attacker with low-privilege access can trigger a denial of service by sending an oversized, specially crafted request payload. Processing the request forces resource-intensive memory allocation that exhausts the Node.js heap in the Kibana process. The process then crashes and becomes unavailable to all users. The flaw maps to Excessive Allocation (CAPEC-130) and is network-exploitable without user interaction. Elastic addressed the issue in the Kibana 8.19.19, 9.3.8, and 9.4.4 security update.

Critical Impact
A low-privileged authenticated user can crash Kibana remotely by submitting a single oversized payload, disrupting availability of dashboards, alerts, and search interfaces for all tenants.

Affected Products

Elastic Kibana versions prior to 8.19.19
Elastic Kibana 9.x versions prior to 9.3.8
Elastic Kibana 9.4.x versions prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE-2026-63260 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63260

Vulnerability Analysis

The vulnerability resides in Kibana's request-handling pipeline. Kibana accepts a user-supplied payload and allocates memory proportional to its size before enforcing effective size or complexity limits. When the payload is crafted to be oversized, the parsing and internal representation stage consumes enough heap memory to exceed the Node.js --max-old-space-size limit. The V8 engine then aborts the process with an out-of-memory fatal error.

Because Kibana runs as a single Node.js process per instance, exhausting the heap terminates all in-flight sessions. Dashboards, saved searches, alerting workflows, and Fleet management all become unreachable until the process restarts. The impact is scoped to availability only, with no effect on confidentiality or integrity of stored data in Elasticsearch.

Root Cause

The root cause is missing or insufficient bounds validation on inbound request bodies before Kibana performs deserialization and object construction. The application allocates buffers, parses structures, and builds internal representations without first rejecting payloads that exceed safe processing thresholds. This is a canonical Excessive Allocation weakness described in CAPEC-130.

Attack Vector

An attacker requires an authenticated Kibana session with low privileges. From a network position that can reach the Kibana HTTP endpoint, the attacker issues a single request containing an oversized payload to a vulnerable endpoint. Kibana attempts to allocate heap memory to process the request and terminates with an out-of-memory condition. Repeated requests can be used to keep the service in a persistent crash-loop state.

No verified exploit code is publicly available. Refer to the Elastic Security Update Advisory (ESA-2026-71) for vendor technical details.

Detection Methods for CVE-2026-63260

Indicators of Compromise

Kibana process termination events with V8 fatal errors such as FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory.
Sudden spikes in Kibana process resident set size (RSS) immediately preceding a crash.
HTTP requests to Kibana APIs with Content-Length values that are anomalous relative to normal user traffic.
Repeated restarts of the Kibana service recorded by systemd, Kubernetes, or the container runtime.

Detection Strategies

Monitor Kibana stdout/stderr logs and container exit codes for out-of-memory terminations tied to specific authenticated user sessions.
Correlate authentication audit logs with request size metrics to identify low-privileged accounts submitting oversized payloads.
Baseline normal API request sizes per endpoint and alert on statistical outliers, especially against POST and PUT endpoints.

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized SIEM or data lake for correlation with process crash telemetry.
Track heap utilization via the Kibana monitoring APIs or Elastic Stack Monitoring and alert on rapid growth toward configured limits.
Instrument the reverse proxy or load balancer in front of Kibana to log request body sizes and originating identities.

How to Mitigate CVE-2026-63260

Immediate Actions Required

Upgrade Kibana to version 8.19.19, 9.3.8, or 9.4.4 or later, per the vendor advisory.
Restrict Kibana network exposure to trusted management networks and require VPN or zero-trust access for administrative users.
Review Kibana role assignments and remove unnecessary low-privileged accounts that could be abused to trigger the condition.

Patch Information

Elastic released fixed builds in Kibana 8.19.19, 9.3.8, and 9.4.4. Full details are provided in the Elastic Security Update Advisory (ESA-2026-71). Apply the update to all Kibana nodes, including staging and disaster recovery instances, and restart the service to load the patched code.

Workarounds

Place a reverse proxy such as NGINX or an API gateway in front of Kibana and enforce a strict maximum request body size using directives like client_max_body_size.
Rate-limit authenticated requests per user or IP at the proxy layer to reduce sustained resource exhaustion attempts.
Run Kibana behind a load balancer with multiple instances and automatic restart policies so that a single crash does not remove service availability.

bash

# NGINX reverse proxy example limiting request body size in front of Kibana
http {
    limit_req_zone $binary_remote_addr zone=kibana_rl:10m rate=20r/s;

    server {
        listen 443 ssl;
        server_name kibana.example.com;

        client_max_body_size 2m;
        client_body_buffer_size 128k;
        large_client_header_buffers 4 16k;

        location / {
            limit_req zone=kibana_rl burst=40 nodelay;
            proxy_pass http://kibana_backend:5601;
            proxy_read_timeout 60s;
        }
    }
}