关键漏洞信息 漏洞描述 标题: Inefficient Regulal Expression Complexity in Kibana Leading to Denial of Service 问题类型: CWE-1333 - Inefficient Regular Expression Complexity 影响: CAPEC-492 - Regular Expression Exponential Blowup CVE ID: CVE-2026-26936 严重性: CVSSv3.1: Medium (4.9) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H 影响的版本 8.x: All versions from 8.0.0 up to and including 8.19.10 9.x: All versions from 9.0.0 up to and including 9.2.4 影响的配置 条件: The Elastic AI Assistant for Security is not enabled by default in Kibana. Users must explicitly configure an AI connector and enable the AI Assistant feature. 解决方案和缓解措施 解决方案: The issue is resolved in version 8.19.11, 9.2.5. 无法升级的用户: - Disable Custom Anonymization Rules in Kibana. Elastic Cloud Serverless 状态: The vulnerability was remediated in our Elastic Cloud Serverless offering before the public disclosure.