CVE-2026-72667

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Allocation of Resources Without Limits or Throttling (CWE-770) in
	Kibana can lead to a denial of service via Excessive Allocation
	(CAPEC-130). A specially crafted request submitted by an authenticated
	user with minimal privileges to a validation capability of the
	Observability log analysis feature causes Kibana to perform an
	unbounded amount of concurrent work. This can exhaust the memory
	available to the Kibana process and make Kibana unavailable to all
	users until it is restarted. The severity of the outcome depends on
	the resources allocated to the deployment; on well-provisioned
	deployments a single request may cause degraded performance and
	elevated memory pressure rather than a full outage, but the request is
	inexpensive to repeat.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72667</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72667</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>