Skip to content
OpenAdvisories
Medium WID-SEC-2026-4023 2 CVEs

Fleet: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 18, 2026 · Updated Oct 18, 2026 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Fleet ist eine GitOps-basierte Plattform zur zentralen Verwaltung, Bereitstellung und Überwachung von Kubernetes-Clustern.

Vulnerabilities 2

  • High 7.5
    CVE-2026-111923

    Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing

    Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment e…

    fleetdm fleet
  • High 7.5
    CVE-2026-111924

    Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

    Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauth…

    fleetdm fleet

Revision history

  1. #1

    Initiale Fassung

References