CVE-2026-111923
CVE-2026-111923 · Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
CVSS 8.7 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
fleet
- Versiones
- ≥ 0, < 4.89.0: Afectada (semver)
- 4.89.0: No afectada (semver)
Actualiza a 4.89.0