{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fleet--4.83.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111924"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fleet (\u003c 4.83.0)","Fleet (\u003c 4.89.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","fleet","mdm"],"_cs_type":"advisory","_cs_vendors":["Fleet"],"content_html":"\u003cp\u003eFleet versions prior to 4.83.0 contain a denial of service vulnerability identified as CVE-2026-111924. This vulnerability resides in the application's handling of gzip-compressed request bodies, allowing unauthenticated attackers to exhaust server memory resources. By submitting small, highly compressed payloads with the 'Content-Encoding: gzip' header to unauthenticated endpoints, an attacker can trigger excessive memory consumption during the server-side decompression process. This exploitation path causes the Fleet instance to crash, resulting in a complete service disruption. As this vector does not require authentication, it represents a significant availability risk for internet-facing or otherwise exposed Fleet installations. Defenders should prioritize patching to version 4.83.0 or later to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a denial of service (DoS) state, where the Fleet instance becomes unresponsive or crashes due to memory exhaustion. This impact is relevant to any organization deploying Fleet for infrastructure management, as it allows any unauthenticated network actor to disrupt fleet-wide operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Fleet installations to version 4.83.0 or later immediately to address the underlying memory handling flaw.\u003c/li\u003e\n\u003cli\u003eMonitor webserver and application logs for anomalous 'Content-Encoding: gzip' headers on high-frequency or unauthorized request paths.\u003c/li\u003e\n\u003cli\u003eApply request size limits and compression ratio constraints at the edge (load balancer or WAF) to mitigate memory exhaustion risks until the patch is deployed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T22:08:22Z","date_published":"2026-10-17T20:54:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fleet-dos/","summary":"Fleet versions prior to 4.83.0 are susceptible to a memory exhaustion denial of service attack via crafted gzip-compressed request bodies.","title":"Denial of Service Vulnerability in Fleet","url":"https://feed.craftedsignal.io/briefs/2026-10-fleet-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Fleet (\u003c 4.83.0)","version":"https://jsonfeed.org/version/1.1"}