{"id":"CVE-2026-111924","kind":"vulnerability","aliases":["CVE-2026-111924"],"related":[],"title":"Fleet: gzip request bodies exhaust memory and crash the server","description":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.","summary":"Fleet, the device management server, decompresses gzip request bodies without limiting their size. An unauthenticated attacker can send small, highly compressed requests that expand in memory and crash the whole Fleet instance.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-management","fleet","package","self-hosted"],"not_affected_if":["version-4.83.0-or-later"],"how_to_check":"Check the Fleet version (fleet version or the server image tag); versions before 4.83.0 are affected.","fix":"Upgrade Fleet to 4.83.0 or later.","status":"open","published_at":"2026-10-17T19:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:37:33+00:00","updated_at":"2026-10-23T22:37:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:37:33Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Fleet to 4.83.0 or later.","reach":"internet","title":"Fleet: gzip request bodies exhaust memory and crash the server","impact":"low","summary":"Fleet, the device management server, decompresses gzip request bodies without limiting their size. An unauthenticated attacker can send small, highly compressed requests that expand in memory and crash the whole Fleet instance.","category":"package","who_cares":["fleet","self-hosted","device-management"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes the entire Fleet server with small gzip requests","analyst_note":"","how_to_check":"Check the Fleet version (fleet version or the server image tag); versions before 4.83.0 are affected.","needs_analyst":false,"not_affected_if":["version-4.83.0-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000459,"input_tokens":2933,"output_tokens":332,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111924':13A,16A '-2026':12A,15A '4.83.0':59C 'allow':67C 'attack':40B,69C,81C 'bodi':4A,33B,80C 'compress':45B,78C,86C 'contain':60C 'content':90C 'content-encod':89C 'crash':8A,52B,100C 'cve':11A,14A 'decod':99C 'decompress':30B 'denial':62C 'devic':18B,27B 'device-manag':17B 'encod':91C 'endpoint':95C 'entir':102C 'exhaust':5A,71C 'expand':48B,97C 'fleet':1A,20B,25B,55B,57C,103C 'gzip':2A,31B,77C,92C 'gzip-compress':76C 'high':44B,85C 'host':24B 'instanc':56B,104C 'limit':35B 'manag':19B,28B 'memori':6A,50B,73C 'packag':21B 'request':3A,32B,46B,79C,87C 'self':23B 'self-host':22B 'send':42B,75C,83C 'server':10A,29B,72C 'servic':64C 'size':37B 'small':43B,84C 'unauthent':39B,68C,94C 'vulner':65C 'whole':54B 'without':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111924","severity":null,"published_at":"2026-10-17T19:16:35+00:00","modified_at":"2026-10-19T22:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}