{"id":"EUVD-2026-16744","enisaUuid":"5586671e-dc71-3028-bc16-133eb720bd57","description":"Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition. Version 4.81.0 patches the issue.","datePublished":"Mar 27, 2026, 6:23:49 PM","dateUpdated":"Mar 31, 2026, 1:38:29 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp\n","aliases":"CVE-2026-26061\nGHSA-99hj-44vg-hfcp\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"f76511a0-531d-313f-a12b-95bf85068249","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.81.0"}],"enisaIdVendor":[{"id":"82706419-6f77-3f7c-9a73-d733adb625e4","vendor":{"name":"fleetdm"}}],"enisaIdVulnerability":[{"id":"0c8f2ff8-8fea-3c07-a450-f5ea6cdc9965","vulnerability":{"id":"GHSA-99hj-44vg-hfcp","description":"Fleet\u0027s unbounded request body read allows remote Denial of Service","datePublished":"Mar 27, 2026, 6:17:42 PM","dateUpdated":"Mar 27, 2026, 9:47:50 PM","baseScore":0.0,"references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26061\nhttps://github.com/fleetdm/fleet\n","enisa_id":"EUVD-2026-16744\n","aliases":"CVE-2026-26061\nGHSA-99hj-44vg-hfcp\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:54:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2ba49957-be0e-3383-9f87-77c6e7ff77b1","vulnerability":{"id":"CVE-2026-26061","description":"Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition. Version 4.81.0 patches the issue.","datePublished":"Mar 27, 2026, 6:23:49 PM","dateUpdated":"Mar 31, 2026, 1:38:29 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp\n","enisa_id":"EUVD-2026-16744\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Oct 27, 2026, 7:20:03 AM","vulnerabilityProduct":[{"id":"0ed563d2-1adf-3c2f-bcd8-4f1c4c9f68f0","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.81.0"}],"vulnerabilityVendor":[{"id":"dbe8c016-27c7-3f9f-8c88-7d40471a1a80","vendor":{"name":"fleetdm"}}]}}],"enisaIdAdvisory":[]}