CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-49089

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

Score
6.5 medium
Published
2026-08-13
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Allocation of Resources Without Limits or Throttling (CWE-770) in
	Kibana can lead to denial of service via Excessive Allocation
	(CAPEC-130). A query expression accepted by a connector reporting
	operation was processed without any limit on its size, and an
	oversized expression caused the Kibana process to spend an unbounded
	amount of time evaluating it. An authenticated user with read-only
	privileges was able to send a single request that left Kibana unable
	to serve any user until the process was restarted.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-49089</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-49089</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>