Threats tagged 'ghsa-jc4v-4w5q-xhc2'

Fleet versions prior to 4.89.0 have an unbounded recursion vulnerability in the Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to send a crafted binary plist payload that triggers exponential resource consumption, causing the server to crash. The vulnerability can be exploited by sending a payload of about 150 bytes to the enrollment endpoints, leading to CPU and memory exhaustion.