Description
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
Published: 2026-10-17
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
Title Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
First Time appeared Fleetdm
Fleetdm fleet
Weaknesses CWE-409
CPEs cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*
Vendors & Products Fleetdm
Fleetdm fleet
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Fleetdm Fleet
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-17T18:46:37.369Z

Reserved: 2026-10-17T12:19:42.358Z

Link: CVE-2026-111924

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-17T19:16:35.257

Modified: 2026-10-17T19:16:35.257

Link: CVE-2026-111924

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T21:30:06Z

Weaknesses