CVE-2026-42399

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-42407.5A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_sCVE-2026-424006.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated uCVE-2026-424015.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access tCVE-2026-424027.5Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-PolicCVE-2026-424037.5Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy referenCVE-2026-424047.2Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. WhenCVE-2026-424068.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-424084.4When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenCVE-2026-424097.5When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed rCVE-2026-42416.3A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /adminCVE-2026-424106.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (forCVE-2026-424118.1Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.