high7.5
CVE-2026-26061
Fleet's unbounded request body read allows remote Denial of Service
Impact
Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition. Version 4.81.0 patches the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/fleetdm/fleet/v4 | < 4.43.5-0.20260113202849-bbc1aef2987d | 4.43.5-0.20260113202849-bbc1aef2987d |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fleetdm | Fleet | before 4.81.0 |