CVE-2026-111923 Details
Description
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
A denial-of-service vulnerability has been identified in Fleet versions prior to 4.89.0. This issue arises from unbounded recursion in the parsing of Apple Mobile Device Management (MDM) enrollment property lists. Unauthenticated attackers can exploit this vulnerability by sending a crafted binary plist payload, approximately 150 bytes in size, to the enrollment endpoints. The flawed parser processes object references recursively without any depth or cycle limitations, leading to exponential memory allocation or infinite recursion. This exploitation exhausts CPU and memory resources, causing the Fleet server to crash.
Users can upgrade to Fleet version 4.89.0 or later, where this vulnerability has been patched. If an immediate upgrade is not possible, it is recommended to restrict network access to the Apple MDM enrollment endpoints to trusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fleet | < 4.89.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |