CVE-2026-111924
Received Received - Intake

Memory Exhaustion via Gzip Compression in Fleet

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111924
EUVD
EUVD-2026-103292

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fleetdm fleet 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Fleet before version 4.83.0 has a denial of service vulnerability where unauthenticated attackers can send small, highly compressed gzip requests to unauthenticated endpoints. The server decompresses these requests, causing the data to expand significantly and exhaust server memory, crashing the entire Fleet instance.

Detection Guidance

Monitor for unusually large memory usage on the Fleet server during request processing. Check for repeated gzip-compressed requests to unauthenticated endpoints. Use network traffic analysis tools like tcpdump or Wireshark to inspect request headers for Content-Encoding: gzip. Look for crashes or high memory consumption in Fleet logs.

Impact Analysis

This vulnerability can cause your Fleet server to crash due to excessive memory consumption, leading to downtime and loss of service availability. It does not expose data or allow unauthorized access but disrupts normal operations.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through memory exhaustion. It does not involve data exposure, authentication bypass, or integrity compromise, which are key concerns for GDPR and HIPAA compliance. However, prolonged downtime could disrupt access to personal or health data, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade Fleet to version 4.83.0 or later immediately. As a temporary measure, configure your reverse proxy or load balancer to reject gzip-encoded requests if agents do not require compression. Block unauthenticated endpoints from receiving gzip-compressed data at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart