Fleet CVE-2026-111924

Exploitation requires only that a Fleet server (any version before 4.83.0) be reachable over the network and that an attacker send an HTTP request with the Content-Encoding: gzip header to one of Fleet's unauthenticated endpoints; the server decodes the compressed body prior to authentication, so no credentials, user interaction, or special configuration are needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factors are network reachability of the Fleet instance (internet-exposed instances are most at risk; purely internal deployments reduce exposure) and the version boundary - instances already upgraded to 4.83.0 or later are not affected. Impact is confined to availability: the attack crashes the service but does not expose or alter data.

Signals are moderately consistent and point to a real but bounded availability threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms remote, low-complexity, unauthenticated exploitation with high impact confined to availability - no confidentiality or integrity exposure - matching CWE-409 (improper handling of highly compressed data, i.e. a decompression/zip-bomb DoS). The 8.7 base score is driven entirely by the ease of reaching unauthenticated endpoints and the ability to crash the whole instance, not by data compromise. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so exploitation probability and in-the-wild activity cannot be quantified; status is therefore 'no public exploit identified at time of analysis.' The vulnerability was reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-3982-g48v-9rwh), which lends credibility to the technical details. Net assessment: a credible, easy-to-trigger service-outage bug that warrants prompt patching for internet-exposed Fleet servers, but it is availability-only with no evidence of active exploitation, so it ranks below RCE or data-exposure criticals despite the high-8 score.

An unauthenticated attacker sends a small HTTP request carrying a Content-Encoding: gzip body - a 'gzip bomb' that is tiny on the wire but expands enormously when Fleet decompresses it. Because the server allocates memory to decode the body before authentication, a handful of such requests exhaust available memory and crash the entire Fleet instance, denying service to all managed devices and operators. No public exploit code is identified, but the technique is trivial to reproduce given the low attack complexity (AC:L) and absence of authentication (PR:N).