Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Advisories

Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Severity: high
Date: 10/17/2026
Affecting: fleet >= 0, < 4.83.0
CVE: CVE-2026-111924
CWE: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-3982-g48v-9rwh)
Credit: fuzzztf
Description: Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo