PT-2026-44510 · Elastic · Kibana

Ismisepaul + 1 · CVE-2026-42399 · Published 2026-05-28 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authenticated low-privileged user can cause a denial of service by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. This leads to uncontrolled resource consumption through excessive allocation, where the resulting data structure grows without bound, exhausting available memory and causing the service to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-ELK-2026-42399

BIT-KIBANA-2026-42399

CVE-2026-42399

Affected Products

Kibana

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42399.json · Exploit
• https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42399 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42399 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elk-2026-42399 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2026-42399 · Vendor Advisory
• https://t.me/cveNotify/165471 · Telegram Post