Nginx CVE-2026-26061

No special conditions — remote unauthenticated attacker can exploit multiple HTTP endpoints in Fleet server that lack request body size limits by sending large or repeated payloads, causing denial-of-service through memory exhaustion.

Real-world risk is moderate despite the unauthenticated attack surface. The vulnerability explicitly impacts availability only with no data exposure, authentication bypass, or privilege escalation according to the advisory. No CVSS score was provided, limiting quantitative risk comparison, but the unauthenticated nature and low technical complexity suggest a likely CVSS vector similar to AV:N/AC:L/PR:N, indicating network-accessible attack with low barriers. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not being actively exploited in the wild. The practical impact is service disruption rather than compromise, and effective workarounds exist via reverse proxy controls. Organizations using Fleet should prioritize patching based on their service availability requirements and public exposure, but this is not a critical compromise risk comparable to authentication bypass or remote code execution vulnerabilities.

An unauthenticated remote attacker identifies publicly accessible Fleet server endpoints and crafts HTTP POST requests with multi-gigabyte request bodies targeting vulnerable unauthenticated handlers. By sending sustained large requests or parallelizing multiple connections, the attacker forces the Fleet server process to allocate excessive heap memory until exhaustion occurs, triggering an out-of-memory crash and service restart. This creates a sustained denial-of-service condition affecting fleet management operations for connected devices until mitigation controls are deployed.