CVE-2026-63139

{
  "id": "CVE-2026-63139",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T21:16:52.957",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance."
    },
    {
      "lang": "es",
      "value": "Consumo de Recursos No Controlado (CWE-400) en Kibana puede conducir a denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un usuario autenticado con bajos privilegios puede explotar una vulnerabilidad de consumo de recursos no controlado en la funcionalidad Canvas de Kibana enviando una solicitud especialmente diseñada, provocando la terminación del proceso del servidor de Kibana y resultando en una denegación de servicio para todos los usuarios de la instancia de Kibana afectada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.19.18",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.4.0",
              "lessThanOrEqual": "9.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.3.0",
              "lessThanOrEqual": "9.3.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:31:55.635990Z",
          "id": "CVE-2026-63139",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.19.0",
              "versionEndExcluding": "8.19.19",
              "matchCriteriaId": "BA6F99D8-CB5A-4653-BBF3-30A6E13B4632"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.3.0",
              "versionEndExcluding": "9.3.8",
              "matchCriteriaId": "01C6B7D2-F5EE-4FF0-B0A2-EAF2C456E627"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.4",
              "matchCriteriaId": "DE10B417-76BB-4C6D-8D1C-5B029497F013"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}