CVE-2026-26061: Fleet's unbounded request body read allows remote Denial of Service

March 27, 2026

Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (DoS) condition.

References

github.com/advisories/GHSA-99hj-44vg-hfcp
github.com/fleetdm/fleet
github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp
nvd.nist.gov/vuln/detail/CVE-2026-26061

Code Behaviors & Features

Detect and mitigate CVE-2026-26061 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →