Fleet's unbounded request body read allows remote Denial of Service

CVE-2026-26061 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Summary

Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition.

Impact

An unauthenticated attacker could cause the Fleet server process to exhaust available memory and restart by sending oversized or repeated HTTP requests to affected endpoints.

This vulnerability impacts availability only. There is:

  • No exposure of sensitive data
  • No authentication bypass
  • No privilege escalation
  • No integrity impact

Workarounds

If upgrading immediately is not possible, the following mitigations can reduce exposure:

  • Apply request body size limits at a reverse proxy or load balancer (e.g., NGINX, Envoy).
  • Restrict network access to endpoints to known IP ranges where feasible.
  • Monitor memory usage and restart frequency for abnormal patterns.

For More Information

If there are any questions or concerns about this advisory, please contact us at:

Email Fleet at [email protected]

Credits

Fleet thanks @fuzzztf for responsibly reporting this issue.

Basic information

Type
reviewed
Severity
high
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2026-03-27 18:17:42 UTC
Updated
2026-04-01 06:11:47 UTC
GitHub reviewed
2026-03-27 18:17:42 UTC
NVD published
2026-03-27

EPSS Score

Score Percentile
0.06% 18.46%

CVSS Scores

Base score Version Severity Vector
8.7 4.0 —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:N)
No additional preconditions are required beyond normal reachability.
Privileges required (PR:N)
No privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:N)
No confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:N)
No integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:H)
High availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N)
No availability impact on subsequent systems.

Identifiers

Type Value
GHSA GHSA-99hj-44vg-hfcp ↗
CVE CVE-2026-26061 ↗

CWEs

CWE id Name
CWE-770 Allocation of Resources Without Limits or Throttling

Credits

  • fuzzztf (reporter)
  • MagnusHJensen (remediation_developer)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
go github.com/fleetdm/fleet/v4 < 4.43.5-0.20260113202849-bbc1aef2987d 4.43.5-0.20260113202849-bbc1aef2987d —

References

cvelogic Threat Intelligence