CyberRota Analysis
AI-GeneratedKibana is vulnerable to a denial-of-service attack due to improper handling of user-supplied document fields in the Playground for RAG feature, which can lead to excessive resource allocation without limits. An attacker can exploit this flaw by sending a specially crafted request, causing the Kibana instance to consume excessive memory and processing power, potentially leading to service outages. Organizations using Kibana should prioritize addressing this vulnerability to prevent potential disruptions in service availability.
Original NVD Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.