Fleet DM Exposes Memory Exhaustion Flaw in Versions Prior to 4.83.0
Unauthenticated attackers can crash Fleet instances by sending compressed requests that expand during decoding, according to the National Vulnerability Database.
Key points
- CVE-2026-111924 affects Fleet versions before 4.83.0
- The flaw allows unauthenticated denial of service attacks
- Attackers send gzip-compressed bodies that exhaust server memory
Fleet DM contains a high-severity denial of service vulnerability that allows unauthenticated attackers to crash the entire application instance. The National Vulnerability Database rated CVE-2026-111924 with a CVSS score of 8.7, classifying it as a high-severity issue.
What happened
The vulnerability exists in Fleet versions prior to 4.83.0, according to the National Vulnerability Database record for CVE-2026-111924. Attackers can exploit this flaw by sending small, highly compressed HTTP request bodies using the Content-Encoding: gzip header to unauthenticated endpoints. When the server processes these requests, it decodes the compressed data, causing the payload to expand significantly during transmission. This expansion exhausts the server's available memory resources, leading to a complete crash of the Fleet instance.
The weakness is categorized under CWE-409, which relates to improper handling of highly compressible data before decompression. The attack requires no authentication, meaning any network-connected actor can trigger the memory exhaustion condition. The resulting denial of service impacts the availability of the entire Fleet management platform for all users.
Why it matters
This vulnerability poses a significant risk to organizations relying on Fleet for device management and security monitoring. As Patch Gazette reported on 2026-10-14, Microsoft released updates for System.Security.Cryptography.Xml to fix a network-based denial of service vulnerability affecting versions 8 through 11.
The unauthenticated nature of this attack vector lowers the barrier for entry for threat actors. Systems exposed directly to the internet or poorly segmented internal networks face immediate risk. A successful exploit results in total service unavailability, potentially disrupting critical IT operations and security workflows dependent on Fleet.
What to watch
- Monitor server memory usage for unusual spikes during request processing
- Check access logs for high volumes of gzip-encoded requests to unauthenticated endpoints
- Verify that your Fleet version is 4.83.0 or later to confirm patch status
- Watch for vendor announcements regarding additional mitigation strategies or configuration updates
Who needs to act first
Teams should prioritize updating systems that are directly accessible from untrusted networks or the public internet. Identify all instances of Fleet running versions prior to 4.83.0 and schedule immediate upgrades. Before applying updates, create full system backups to ensure rollback capability if issues arise. Test the upgrade process in a non-production environment first to validate stability. If an immediate update is not possible, restrict network access to the Fleet endpoints using firewalls or web application filters to block unauthorized gzip requests.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe: Fleet DM
- Inventory all Fleet installations to identify versions prior to 4.83.0
- Apply the latest vendor update to patch CVE-2026-111924 once available
- Configure network security groups to restrict access to unauthenticated Fleet endpoints
- Monitor system logs for signs of memory exhaustion or unusual compression traffic
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Fleet are affected by CVE-2026-111924?
All versions of Fleet prior to 4.83.0 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigned a CVSS score of 8.7 to CVE-2026-111924.
Does the attack require authentication?
No, the vulnerability allows unauthenticated attackers to trigger the denial of service condition.
