Vulnerability in fleetdm fleet

[ Description ]Official description

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund18 Oct 2026WID-SEC-2026-4023

  Fleet: Multiple vulnerabilities allow denial of service Translated from German

  CVE-2026-111924CVE-2026-111923

[ References ]References

• github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh
• www.vulncheck.com/advisories/fleet-before-4.83.0-denial-of-service-via-unbounded-gzip-d…