CVE-2026-111923

Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing

State: Published
Severity: 8.7 High
Published: Oct 17, 2026
Updated: Oct 19, 2026
Reserved: Oct 17, 2026

Description

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-674 Uncontrolled Recursion

Affected Products

Product	Versions
fleetfleetdm	before 4.89.0Affected 4.89.0Not affected

References

GitHub Security Advisory (GHSA-x467-vgxf-2g6h)vendor-advisory
VulnCheck Advisory: Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.