CVE-2026-26061
Fleet's unbounded request body read allows remote Denial of Service
CVSS Score
0.0
EPSS Score
0.1%
EPSS Percentile
16th
Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition. Version 4.81.0 patches the issue.
| CWE | CWE-770 |
| Vendor | fleetdm |
| Product | fleet |
| Published | Mar 27, 2026 |
| Last Updated | Mar 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for fleetdm fleet
Be the first to know when new unknown vulnerabilities affecting fleetdm fleet are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
fleetdm / fleet
< 4.81.0