Fleet DM Gzip Decompression Flaw Triggers Memory Exhaustion Denial of Service

Fleet DM contains a denial of service vulnerability that enables unauthenticated attackers to exhaust server memory. This issue, tracked as CVE-2026-111924, affects all versions of the software prior to 4.83.0. The flaw allows remote actors to crash the entire Fleet instance by sending specifically crafted requests. This mirrors the unbounded memory allocation risks seen in other decompression flaws, such as the Eclipse Vert.x issue Firewall Pulse reported on 2026-10-16.

Root cause

The vulnerability stems from improper handling of gzip-compressed request bodies. According to the NVD record, the weakness is classified as CWE-409. The server processes gzip-compressed request bodies that expand during decoding. This expansion allows attackers to exhaust server memory. The source material describes the flaw as allowing unauthenticated attackers to send small, highly compressed requests that expand during decoding.

Attack path

Attackers do not need authentication to exploit this flaw. They send small requests with the Content-Encoding header set to gzip to any unauthenticated endpoint. These requests contain highly compressed data that expands significantly during decoding. The server processes the expansion, rapidly consuming available RAM. Once memory is exhausted, the Fleet instance crashes, resulting in a complete denial of service for all users.

Affected versions

• Fleet DM versions prior to 4.83.0 are affected by this vulnerability.
• The source material defines the affected range as "Fleet before 4.83.0".
• Organizations running older releases remain exposed to unauthenticated remote exploitation.

Mitigation

• Upgrade Fleet DM to version 4.83.0 or later to resolve the vulnerability.
• Restrict access to unauthenticated endpoints using network-level controls or firewalls.
• Monitor server memory usage for sudden spikes indicative of decompression attacks.
• Implement request size limits to mitigate the impact of large payload expansions.

Signals worth monitoring

Teams usually observe rapid memory growth on servers processing incoming requests. Check whether application logs show repeated gzip decoding operations from single sources. Look for alerts triggered by resource exhaustion or process crashes. Verify if unauthenticated endpoints are receiving unusually small requests with high compression ratios. Implement rate limiting on public-facing endpoints to slow down potential attackers. Ensure monitoring tools capture memory usage trends over short intervals to detect sudden spikes.

What to do and how to stay safe: Fleet DM

• Verify your current Fleet DM version and upgrade to 4.83.0 or later immediately.
• Review firewall rules to restrict access to unauthenticated Fleet endpoints.
• Monitor server memory metrics for abnormal spikes that indicate decompression attacks.
• Check application logs for frequent gzip decoding errors or resource warnings.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Fleet DM are affected by CVE-2026-111924?

All versions of Fleet DM prior to 4.83.0 are affected by this vulnerability.

What is the severity rating for this CVE?

The NVD rates CVE-2026-111924 as HIGH with a CVSS score of 8.7.

Can authenticated users be targeted by this flaw?

No, the vulnerability allows unauthenticated attackers to exploit the system.