{"id":"CVE-2026-111923","title":"Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing","summary":"Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 byt…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"fleetdm","product":"fleet","affected":["fleet < 4.89.0"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T18:46:36.681Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111923","references":[{"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h","label":"GitHub Security Advisory (GHSA-x467-vgxf-2g6h)"},{"url":"https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing","label":"VulnCheck Advisory: Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T19:08:56.592Z","slug":"CVE-2026-111923","body":"## Overview\n\nFleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.\n\n## Affected\n\n- `fleet < 4.89.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}