---
id: "CVE-2026-111924"
kind: "vulnerability"
aliases: ["CVE-2026-111924"]
title: "Fleet: gzip request bodies exhaust memory and crash the server"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["device-management", "fleet", "package", "self-hosted"]
not_affected_if: ["version-4.83.0-or-later"]
published_at: "2026-10-17T19:16:35+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:37:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111924", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Fleet: gzip request bodies exhaust memory and crash the server

Fleet, the device management server, decompresses gzip request bodies without limiting their size. An unauthenticated attacker can send small, highly compressed requests that expand in memory and crash the whole Fleet instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the Fleet version (fleet version or the server image tag); versions before 4.83.0 are affected.

## Fix

Upgrade Fleet to 4.83.0 or later.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111924

## From the sources

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_