SB2026022719 - Two vulnerabilities in Elastic Kibana

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inefficient regular expression complexity (CVE-ID: CVE-2026-26936)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote user can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

2) Resource exhaustion (CVE-ID: CVE-2026-26937)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the Timelion component. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-14/385250
• https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-15/385251