CVE-2026-111923: Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Fleet versions before 4.89.0 are affected where Apple MDM enrollment endpoints are reachable by an attacker. Exploitation does not require authentication or user interaction.
What does an attacker need to send to trigger the denial of service?
An attacker can submit a crafted binary property list payload of roughly 150 bytes to an enrollment endpoint. The payload triggers unbounded recursion, leading to exponential allocation or infinite recursion and exhausting CPU and memory.
What is the remediation?
Upgrade Fleet to version 4.89.0 or later. The affected version range is Fleet releases before 4.89.0.