Elastic Kibana Resource Exhaustion Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Elastic Kibana versions prior to 7.17.23 and 8.14.2. The issue arises from an unlimited allocation of resources in response to certain requests, specifically to the '/api/log_entries/summary' endpoint. This vulnerability can be exploited by users with read access to the Observability-Logs feature, potentially leading to a crash of the Kibana instance.

Impact

Exploitation of this vulnerability causes a crash of the Kibana instance, disrupting service and availability.

Remediation

Users can upgrade to Kibana versions 7.17.23 or 8.14.2 to address this vulnerability.