CVE-2026-111923

Publié : 17 octobre 2026

Modifié : 17 octobre 2026

Score CVSS

7.5

HIGH

Description détaillée

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing

Dernières Vulnérabilités

CVE-2026-108117

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107772

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107345

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS