CVE-2026-111923: Uncontrolled Recursion in fleetdm fleet
Description
Fleet versions before 4.89.0 have an unbounded recursion vulnerability in the Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to send a crafted binary plist payload to enrollment endpoints, causing exponential resource consumption that crashes the server. The vulnerability can lead to denial of service by exhausting CPU and memory resources.
CVSS v4.0
Score 8.7high
Affected software
fleetdm
fleet
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111923 describes an unbounded recursion vulnerability in Fleet's Apple MDM enrollment property list parsing prior to version 4.89.0. An attacker can exploit this by sending a specially crafted binary plist payload of approximately 150 bytes to the enrollment endpoints. This triggers exponential allocation or infinite recursion, resulting in CPU and memory exhaustion and ultimately crashing the server. The vulnerability requires no authentication and has a CVSS 4.0 base score of 8.7, indicating high severity.
Potential Impact
Unauthenticated attackers can cause a denial of service by crashing the Fleet server through resource exhaustion. This impacts availability but does not indicate direct code execution or data compromise based on the provided data.
Mitigation Recommendations
Upgrade Fleet to version 4.89.0 or later where this vulnerability is fixed. Since the vulnerability affects versions prior to 4.89.0, applying the official fix by updating is the recommended mitigation. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-17T12:19:42.358Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3c6d42cdf04f65652081d
Added to database: 10/17/2026, 19:04:52 UTC
Last enriched: 10/17/2026, 19:18:17 UTC
Last updated: 10/17/2026, 19:19:31 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.