Fleet: Denial of service via unbounded gzip decompression
Summary
Fleet versions before 4.83.0 do not limit the size of gzip-decompressed request bodies. An unauthenticated attacker with network access can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints, exhausting server memory and crashing the entire Fleet instance. The flaw affects availability only; no data disclosure, authentication bypass or integrity impact is documented.
Affected
- Fleet (Go package github.com/fleetdm/fleet) before 4.83.0
- Source conflict: a third-party page cites the range as "= v4.83.0" and a different advisory ID; verify on the GitHub advisory.
Fixed in
- Fleet 4.83.0 and later (applies the request size limit to the decompressed body)
Workaround
- Upgrading to 4.83.0 is the only vendor-documented fix.
- If upgrading is not immediately possible, reject requests with Content-Encoding: gzip at a reverse proxy or load balancer, provided Fleet agents are not configured to compress requests.
- Rate limiting and request size restrictions at the proxy layer may reduce the impact (generic suggestion, not confirmed by Fleet).
Exploitation
- Known exploited: no evidence found.
- Public proof of concept: none found.
- Automatable: yes (CISA SSVC); exploitation: none (CISA SSVC).
Our recommendation
- Identify all Fleet deployments and their versions.
- Prioritise instances reachable from the internet; upgrade them to 4.83.0 or later first.
- Where upgrading is not immediate, apply the gzip rejection or request size limits at the reverse proxy.
- Monitor for repeated crashes or memory exhaustion of the Fleet server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3982-g48v-9rwh github.com
- VulnCheck advisory www.vulncheck.com
- NVD / Vulners CVE record vulners.com
- VulDB CVE entry vuldb.com
- EUVD record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:06.
Original description (NVD)
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.