CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-49096

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

Score
4.3 medium
Published
2026-08-13
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana93kibana939.3.8fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of
	service via Input Data Manipulation (CAPEC-153). Malformed link syntax
	stored in a case comment was not rejected or sanitized when the
	comment was later formatted for display, and the resulting unhandled
	error prevented the affected case from being displayed. An
	authenticated user holding privileges to comment on a case could store
	such a comment, after which that case became inaccessible to every
	user who opened it until the stored comment was removed.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-49096</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-49096</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>