{"schema":"threatline.record/2","record":{"id":"GHSA-3982-g48v-9rwh","aliases":["GHSA-3982-g48v-9rwh"],"summary":"Unbounded gzip decompression of request bodies allows unauthenticated denial of service","details":"### Summary\n\nFleet limits the size of incoming request bodies, but when a request was sent with `Content-Encoding: gzip`, Fleet did not limit the size of the decompressed data. A compressed payload within the request size limit could expand to hundreds of megabytes or more while Fleet decoded it, exhausting server memory. This was an incomplete part of the fix for GHSA-99hj-44vg-hfcp.\n\n### Impact\n\nAn unauthenticated attacker with network access to the Fleet server could crash the server by sending small, highly compressed requests to unauthenticated endpoints, causing a denial of service for the whole instance.\n\nThis vulnerability impacts **availability only**. There is:\n\n- No exposure of sensitive data\n- No authentication bypass\n- No privilege escalation\n- No integrity impact\n\n### Patches\n\nFleet v4.83.0 applies the request size limit to the decompressed body as well as the raw body.\n\n### Workarounds\n\nIf upgrading immediately is not possible, reject requests with `Content-Encoding: gzip` at a reverse proxy or load balancer, if your Fleet agents are not configured to compress requests.\n\n### Credits\n\nWe thank @fuzzztf for responsibly reporting this issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\n\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n","categories":["Unclassified"],"product":"github.com/fleetdm/fleet","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh","source_modified_at":"2026-10-02T15:46:55Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"go","name":"github.com/fleetdm/fleet"},"range":"< 4.83.0"}],"fixed_versions":[],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-02T15:46:55Z","modified_at":"2026-10-02T15:46:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-02T15:46:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-02T15:46:55Z","content_hash":"88f5809b04124663ce5f37c2abba704551744efe0b2cf2a105e275183a73c1d6"}}