CVE-2026-111923
CVE-2026-111923 · Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
fleet
- Versions
- ≥ 0, < 4.89.0: Affected (semver)
- 4.89.0: Not affected (semver)
Update to 4.89.0