CVE-2026-56150 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
An attacker can cause a denial of service in Elastic Fleet Server by submitting crafted requests to an upload endpoint, leading to excessive memory consumption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56150?
CVE-2026-56150 is a medium-severity denial of service vulnerability in Elastic Fleet Server, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.
Weakness: CWE-770
Which versions are affected by CVE-2026-56150?
It affects 1 product.
Products include Elastic Fleet Server.
How do I fix CVE-2026-56150?
No fix has been published for CVE-2026-56150 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-56150 being exploited?
There is no known exploitation of CVE-2026-56150 in the wild and no public exploit code.
Other vulnerabilities in Elastic Fleet Server
- CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File
- CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
- CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Sources
Also known as GHSA-w52p-h72q-gcpf.