Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
CVE-2026-111923
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111923
fleet
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "fleetdm",
"product": "fleet",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.89.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.89.0",
"versionType": "semver"
}
],
"packageURL": "pkg:golang/github.com/fleetdm/fleet",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111923
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #38973 · Revision 1
- Added to Heist Feed
- Publisher date