Is CVE-2026-111924 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111924?

CVE-2026-111924 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-111924

Description

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.