CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72659

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.

Score
6.5 medium
Published
2026-08-13
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Allocation of Resources Without Limits or Throttling (CWE-770) in
	Kibana can lead to denial of service via Excessive Allocation
	(CAPEC-130). A specially crafted, malformed payload submitted to a
	Kibana visualization feature by an authenticated user holding only
	low-privileged access is not correctly validated before use.
	Processing the request causes unbounded memory growth in the Kibana
	process, which is terminated by the host once available memory is
	exhausted. Kibana then becomes unavailable to all users until the
	service is restarted.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72659</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72659</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>