# CVE-2026-49089: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

> CVE-2026-49089: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-49089
Last updated: 2026-09-02T14:19:00Z

- Published: 2026-08-13 19:08 UTC · Updated: 2026-09-02 14:19 UTC · Assigner: elastic
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.47%, 41th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-770

## Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-49089)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-49089)
- [https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-49089 · Markdown: https://rewindex.com/cve/CVE-2026-49089.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-49089 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:46.591Z