CVE-2026-111924: fleetdm fleet, отказ на услуга

Описание

Оригинално описание

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

Засегнати продукти

• fleetdm fleet: преди 4.83.0; 4.83.0

Вид слабост

• CWE-409 Неправилна обработка на силно компресирани данни (усилване на данни)

История

Други уязвимости в fleetdm fleet

• 8.7CVE-2026-111923
• 5.3CVE-2026-103265
• 9.3CVE-2026-103264
• 3.1CVE-2026-101046
• 6.9CVE-2026-101047

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-111924
• https://nvd.nist.gov/vuln/detail/CVE-2026-111924
• https://github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh
• https://www.vulncheck.com/advisories/fleet-before-4.83.0-denial-of-service-via-unbounded-gzip-decompression