Homepage

Allocation of Resources Without Limits or Throttling Affecting kibana-9.4-advanced package, versions <9.4.4-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.38% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KIBANA94ADVANCED-18312146
  • published26 Jul 2026
  • disclosed8 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 8 Jul 2026

NewCVE-2026-55575  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade Minimos:latest kibana-9.4-advanced to version 9.4.4-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kibana-9.4-advanced package and not the kibana-9.4-advanced package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.