Quick answers
- Is CVE-2026-111924 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111924 being exploited in the wild.
- How severe is CVE-2026-111924?
- High severity, with a CVSS score of 7.5, published 17 October 2026.
- Which products and versions are affected?
- Fleet before 4.83.0.
- Is there a fix for CVE-2026-111924?
- Yes: fixed in 4.83.0. Until then: If upgrading is not immediately possible, reject requests with Content-Encoding: gzip at your reverse proxy or load balancer, provided your Fleet agents are not configured to compress requests. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-111924 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-111924?
- Check whether you run Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.83.0
If upgrading is not immediately possible, reject requests with Content-Encoding: gzip at your reverse proxy or load balancer, provided your Fleet agents are not configured to compress requests.
Technical details
The vulnerability exists in Fleet's request body handling: while the server limits the raw size of incoming requests, it fails to limit the decompressed size when Content-Encoding: gzip is used. An attacker can send a small compressed payload that expands to hundreds of megabytes during decompression, exhausting server memory. This affects unauthenticated endpoints and requires only network access.
Affected products
- Fleet Fleet before 4.83.0
Timeline
- 2026-10-02: disclosed
- 2026-10-17: advisory