Fleet (< 4.89.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fleet--4.89.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 17 Oct 2026 20:54:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in Fleethttps://feed.craftedsignal.io/briefs/2026-10-fleet-dos/Sat, 17 Oct 2026 20:54:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-fleet-dos/Fleet versions prior to 4.83.0 are susceptible to a memory exhaustion denial of service attack via crafted gzip-compressed request bodies.Fleet versions prior to 4.83.0 contain a denial of service vulnerability identified as CVE-2026-111924. This vulnerability resides in the application's handling of gzip-compressed request bodies, allowing unauthenticated attackers to exhaust server memory resources. By submitting small, highly compressed payloads with the 'Content-Encoding: gzip' header to unauthenticated endpoints, an attacker can trigger excessive memory consumption during the server-side decompression process. This exploitation path causes the Fleet instance to crash, resulting in a complete service disruption. As this vector does not require authentication, it represents a significant availability risk for internet-facing or otherwise exposed Fleet installations. Defenders should prioritize patching to version 4.83.0 or later to mitigate this risk.

Impact

Successful exploitation of this vulnerability leads to a denial of service (DoS) state, where the Fleet instance becomes unresponsive or crashes due to memory exhaustion. This impact is relevant to any organization deploying Fleet for infrastructure management, as it allows any unauthenticated network actor to disrupt fleet-wide operations.

Recommendation

  • Upgrade Fleet installations to version 4.83.0 or later immediately to address the underlying memory handling flaw.
  • Monitor webserver and application logs for anomalous 'Content-Encoding: gzip' headers on high-frequency or unauthorized request paths.
  • Apply request size limits and compression ratio constraints at the edge (load balancer or WAF) to mitigate memory exhaustion risks until the patch is deployed.
]]>lowadvisorydenial-of-servicevulnerabilityfleetmdm