CVE-2026-111924: Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Fleet instances running versions before 4.83.0 are affected if unauthenticated endpoints can receive requests with gzip-compressed bodies. An attacker can target the instance remotely because no authentication or user interaction is required.
What does an attacker need to do to trigger the issue?
The attacker only needs to send a small, highly compressed request body with the Content-Encoding: gzip header to an unauthenticated endpoint. The body expands during decoding and can exhaust server memory, crashing the Fleet instance.
Is confidentiality or data integrity affected?
The reported impact is availability only. The provided severity vector indicates no confidentiality or integrity impact, while availability impact is high.