CVE-2026-111924: Fleet DOS Compression Bomb Vulnerability

CVE-2026-111924 Overview

CVE-2026-111924 is a denial of service vulnerability affecting Fleet device management server versions prior to 4.83.0. The flaw allows unauthenticated attackers to exhaust server memory by sending small, highly compressed gzip request bodies to unauthenticated endpoints. Fleet decodes these payloads without applying size limits, causing memory expansion that crashes the entire Fleet instance. The vulnerability is categorized under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

Critical Impact

Unauthenticated remote attackers can crash Fleet servers with minimal network traffic by abusing gzip decompression, disrupting fleet-wide device management operations.

Affected Products

• Fleet device management server versions prior to 4.83.0
• Unauthenticated HTTP endpoints that accept Content-Encoding: gzip
• Deployments exposing Fleet to untrusted networks

Discovery Timeline

• 2026-10-17 - CVE-2026-111924 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111924

Vulnerability Analysis

Fleet accepts HTTP requests with Content-Encoding: gzip headers on endpoints that do not require authentication. The server decompresses these request bodies before enforcing any size cap on the resulting data. Attackers exploit this behavior by crafting gzip bombs: tiny compressed payloads that expand to many gigabytes once decoded. Each request forces the server to allocate memory proportional to the decompressed size, not the compressed size received over the network. Repeated or sufficiently large payloads exhaust available memory and terminate the Fleet process.

Root Cause

The root cause is missing input validation during gzip decompression on unauthenticated request paths. Fleet reads the compressed body and expands it into memory without streaming limits, byte caps, or ratio checks. This maps directly to [CWE-409], where applications fail to constrain data amplification during decompression. Because the vulnerable endpoints require no credentials, no prior access or user interaction is needed to trigger the condition.

Attack Vector

An attacker sends an HTTP request to a reachable Fleet endpoint with the Content-Encoding: gzip header and a compressed body designed to expand far beyond safe memory bounds. The Fleet server attempts to decompress the body in full, allocating memory until the process is killed by the operating system or the host becomes unresponsive. The attack is remote, requires no authentication, and can be delivered through standard HTTP tooling. VulnCheck and the Fleet security advisory describe the same unbounded decompression behavior as the trigger. See the GitHub Security Advisory GHSA-3982 and the VulnCheck Advisory: Fleet DoS for additional technical context.

Detection Methods for CVE-2026-111924

Indicators of Compromise

• Fleet process terminated with out-of-memory (OOM) kills in system logs such as dmesg or journalctl
• Inbound HTTP requests to unauthenticated Fleet endpoints carrying Content-Encoding: gzip with abnormally small Content-Length values
• Sudden spikes in Fleet server resident memory followed by service crashes or restarts

Detection Strategies

• Inspect reverse proxy and load balancer logs for repeated gzip-encoded POST requests to Fleet endpoints from the same source
• Alert on anomalously high decompression ratios between received payload size and in-memory buffer growth
• Correlate Fleet application crash events with recent inbound HTTP traffic patterns to identify triggering requests

Monitoring Recommendations

• Track Fleet container or process memory usage and configure alerts for rapid growth beyond baseline
• Enable WAF or reverse proxy rules that log and limit compressed request bodies to Fleet
• Monitor for repeated 5xx responses or connection resets from Fleet immediately after gzip-encoded requests

How to Mitigate CVE-2026-111924

Immediate Actions Required

• Upgrade Fleet to version 4.83.0 or later, which addresses the unbounded decompression behavior
• Restrict network exposure of Fleet endpoints to trusted management networks where feasible
• Deploy a reverse proxy or WAF rule limiting request body size and rejecting excessive compression ratios

Patch Information

Fleet 4.83.0 remediates CVE-2026-111924 by enforcing limits on decompressed request bodies. Administrators should review the GitHub Security Advisory GHSA-3982 for upgrade notes and verify server versions after deployment. Confirm successful mitigation by validating that gzip-encoded oversized requests return an error rather than consuming unbounded memory.

Workarounds

• Place Fleet behind a reverse proxy such as NGINX or Envoy and cap client_max_body_size and decompressed buffer sizes
• Block or rate-limit requests containing Content-Encoding: gzip on unauthenticated Fleet endpoints until patching is complete
• Use network ACLs or security groups to restrict access to Fleet to known administrator sources

# Example NGINX reverse proxy limits in front of Fleet
http {
    client_max_body_size 1m;
    client_body_buffer_size 128k;

    server {
        listen 443 ssl;
        server_name fleet.example.com;

        location / {
            # Reject requests advertising gzip-encoded bodies
            if ($http_content_encoding = "gzip") {
                return 415;
            }
            proxy_pass http://fleet_backend;
        }
    }
}