CVE-2026-26061CWE-770

Fleet's unbounded request body read allows remote Denial of Service

High · published March 27, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition. Version 4.81.0 patches the issue.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-27T18:23Z
EPSS history
Timeline
  • 27 MAR 18:23Z
    Fleet's unbounded request body read allows remote Denial of Service
    cvelistv5