CVE-2026-111923— Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Quick assessment
Affected
fleetdm fleet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
4.89.0 之前的 Fleet 版本在解析 Apple MDM 注册属性列表（property list）时存在无界递归漏洞。该漏洞允许未认证的攻击者通过向注册端点发送约 150 字节的恶意构造二进制 plist 载荷，触发指数级内存分配或无限递归，从而耗尽 CPU 和内存资源，导致服务器崩溃。
Possible ATT&CK Techniques 2 AI
T1499.001 · OS Exhaustion Flood T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111923
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111923
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111923
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111923 (2)
IV. Related Vulnerabilities
Same product: fleet
-
CVE-2026-111924
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Dec -
CVE-2025-23390
Fleet doesn’t validate a server’s certificate when connectin -
CVE-2026-103265
Fleet before 4.89.0 Information Disclosure via MDM Command R -
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identif -
CVE-2026-101047
Fleet before 4.87.0 Unauthenticated iOS App Download via Pre
Same vendor: fleetdm
-
CVE-2026-111924
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Dec -
CVE-2026-103265
Fleet before 4.89.0 Information Disclosure via MDM Command R -
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identif -
CVE-2026-101047
Fleet before 4.87.0 Unauthenticated iOS App Download via Pre -
CVE-2026-101046
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endp
Same weakness: CWE-674
-
CVE-2026-55862
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM func -
CVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/ -
CVE-2026-109449
Symfony: Unbounded Nesting in the Expression Parser Lets Unt -
CVE-2026-109413
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a -
CVE-2026-110263
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureR
V. Comments for CVE-2026-111923
No comments yet