Unbounded Recursion Vulnerability in Fleet MDM Enrollment by FleetDM
CVE-2026-111923

8.7HIGH

Key Information:

Vendor

Fleetdm

Status
Fleet
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111923?

Fleet versions prior to 4.89.0 exhibit an unbounded recursion vulnerability in the parsing of Apple MDM enrollment property lists. This flaw allows unauthenticated attackers to crash the server by sending a specially crafted binary plist payload as small as 150 bytes to the enrollment endpoints. This leads to exponential resource allocation or infinite recursion, potentially exhausting system CPU and memory resources, which disrupts service availability.

Affected Version(s)

fleet 0 < 4.89.0

fleet 4.89.0

References

https://github.com/fleetdm/fleet/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/fleet-before-4.89.0-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fuzzztf
.