CVE-2026-111924 is a high severity (CVSS 7.5) denial of service in Fleet before 4.83.0. Small gzip compressed request bodies expand without a limit and can exhaust server memory. Upgrade to 4.83.0 or later. The sections below cover affected versions, how to check, and what to do first.
What's affected
Fleet before 4.83.0, per the record, VulnCheck and the GitHub advisory, which lists 4.83.0 as patched.
The advisory says Fleet limited the size of incoming bodies but not the size after decompression when Content-Encoding is gzip. It calls this an incomplete part of an earlier fix. Unauthenticated endpoints are the target, and the impact is availability only.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check the Fleet server version in the web interface or the deployed image tag. Anything before 4.83.0 is affected.
Look at memory graphs and restart counts for the server. A spike in memory right before a crash, with small request sizes in the proxy logs, fits this pattern.
What to do now
- Find your Fleet server version.
- Upgrade to 4.83.0 or later.
- Set a memory limit and an automatic restart on the server.
- If a proxy sits in front, limit or reject compressed request bodies on unauthenticated paths where you can.
- Alert on memory pressure so you notice an attack in progress.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-409, improper handling of highly compressed data, also called a decompression bomb. A compression format can turn a few kilobytes into hundreds of megabytes. A size limit on the compressed input does not bound the work after it expands.
The lesson is to enforce the limit on the decoded stream, not just on what arrives. The advisory notes this was a gap left by an earlier fix, which is common when a limit is added in one place but not on every code path. It is not listed in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is a decompression bomb?
A small compressed file that expands into a very large one, exhausting memory or disk.
Does it need authentication?
The advisory says unauthenticated endpoints are affected.
Sources
Last reviewed: 18 October 2026.
