CVE-2026-72628

Katalog CVE

CVSS 6.5 · Medium EPSS 0,47%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada elastic kibana. Skor CVSS 3.1 6.5 (Medium) menurut elastic.co.

Deskripsi (NVD)

Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.

Rincian

Terbit di NVD

1 September 2026

Terakhir diubah

2 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber elastic.co
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090 mitigasi · advisory vendor