High priorityDisclosed

Advisory · CVE-2026-111924

Fleet gzip request bodies can expand without bound and exhaust memory

Fleet before 4.83.0 contains a denial of service flaw in gzip-compressed request handling, so unauthenticated attackers can send small, highly compressed bodies that expand during decoding and crash the whole Fleet instance. CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 17, 2026Independent summary
Vendor
fleetdm
Product
Fleet
Identifier / CWE
CVE-2026-111924
CWE-409
Action timing
Immediate
ELI5

Explain it like I’m five

Fleet unpacks compressed requests without a size ceiling, so a tiny zipped request can inflate in memory until the server runs out.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Small compressed request

    An unauthenticated attacker sends a small, highly compressed request body with Content-Encoding: gzip to an unauthenticated endpoint.

  2. 02Body decoded in full

    Fleet expands the body during decoding without an effective bound.

  3. 03Instance crashes

    Memory is exhausted and the entire Fleet instance crashes.

What happened

Fleet disclosed CVE-2026-111924 for versions before 4.83.0: a denial of service flaw (CWE-409) that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies to unauthenticated endpoints, where they expand during decoding and can crash the entire Fleet instance.

Per the vendor affected data in the NVD record, 4.83.0 is the first unaffected release, so upgrading to 4.83.0 or later is the stated fix. Instances already past that line are not listed as affected.

What to do

  1. Inventory Fleet servers and confirm which release each one runs; long-lived instances are the ones most likely to predate 4.83.0.
  2. Upgrade affected instances to 4.83.0 or later using the project release guidance.
  3. Where a proxy sits in front of Fleet, cap decompressed request body size while remediation is underway.
  4. Hunt for small gzip-encoded requests followed by memory exhaustion or instance restarts.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

This fixed line is several releases back, so exposure here is a patch-hygiene signal. Any Fleet server still before 4.83.0 needs both the upgrade and a look at why it fell behind.