{"id":"CVE-2026-111924","title":"Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression","summary":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-En…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-409"],"vendor":"fleetdm","product":"fleet","affected":["fleet < 4.83.0"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T18:46:37.369Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111924","references":[{"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh","label":"GitHub Security Advisory (GHSA-3982-g48v-9rwh)"},{"url":"https://www.vulncheck.com/advisories/fleet-before-4.83.0-denial-of-service-via-unbounded-gzip-decompression","label":"VulnCheck Advisory: Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T19:08:56.591Z","slug":"CVE-2026-111924","body":"## Overview\n\nFleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.\n\n## Affected\n\n- `fleet < 4.83.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}