CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72628

Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.

Score
6.5 medium
Published
2026-09-01
Links
NVD · cve.org · Report wrong data

Matched ports (6)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org
textproc/kibana95kibana959.5.4fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.21</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Improper Handling of Highly Compressed Data (CWE-409) in Kibana can
	lead to a denial of service via Excessive Allocation (CAPEC-130). An
	authenticated user holding Streams management privileges could supply
	specially crafted content that expands to a far larger volume of data
	during processing, exhausting the memory available to Kibana. The
	Kibana process is terminated by the host and remains unavailable to
	all users until the service is restarted.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72628</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72628</url>
    </references>
    <dates>
      <discovery>2026-09-01</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>