CVE-2026-63260

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-632616.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged a CVE-2026-632624.3Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumven CVE-2026-632636.5Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An au CVE-2026-632645.3Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflect CVE-2026-632658.0Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Pr CVE-2026-632666.8LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document cou CVE-2026-632676.7LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while CVE-2026-632686.7LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name CVE-2026-632696.7LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HL CVE-2026-63274.3IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special CVE-2026-632706.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632725.4LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that ca