CVE-2017-8452 Denial of service in Kibana

What is CVE-2017-8452?

CVE-2017-8452 is a high-severity denial of service vulnerability in Elastic Kibana, published on 16 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes.

Weakness: CWE-769, CWE-775

Which versions are affected by CVE-2017-8452?

It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2017-8452?

No fix has been published for CVE-2017-8452 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-8452 being exploited?

There is no known exploitation of CVE-2017-8452 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p36j-6ff2-h5mm.