Read the docs
TI-2026-40526 Aliases CVE-2026-56150GHSA-w52p-h72q-gcpf

Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service

Priority LOW 33CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00476 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticFleet Server9.0.0 – 9.2.4; 8.0.0 – 8.19.10—No fix listedCNA
  • Fleet Server VendorElastic Affected 9.0.0 – 9.2.4; 8.0.0 – 8.19.10 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:*8.0.0 to before 8.19.11; 9.0.0 to before 9.2.5VulnerableElastic
  • cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.19.11; 9.0.0 to before 9.2.5 Vulnerable ·Elastic

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56150
  2. 2026-10-03 Alias added: GHSA-w52p-h72q-gcpf

References

Advisory 1

  • TI-2023-25169 Fleet Server Insertion of Sensitive Information into Log File CVSS 3.1HIGH 8.1
  • TI-2026-50895 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure CVSS 3.1MEDIUM 6.5
  • TI-2026-54637 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences