github.com/fleetdm/fleet: Unbounded gzip decompression of request bodies allows unauthenticated denial of service

Summary

Fleet limits the size of incoming request bodies, but when a request was sent with Content-Encoding: gzip, Fleet did not limit the size of the decompressed data. A compressed payload within the request size limit could expand to hundreds of megabytes or more while Fleet decoded it, exhausting server memory. This was an incomplete part of the fix for GHSA-99hj-44vg-hfcp.

Impact

An unauthenticated attacker with network access to the Fleet server could crash the server by sending small, highly compressed requests to unauthenticated endpoints, causing a denial of service for the whole instance.

This vulnerability impacts availability only. There is:

• No exposure of sensitive data
• No authentication bypass
• No privilege escalation
• No integrity impact

Patches

Fleet v4.83.0 applies the request size limit to the decompressed body as well as the raw body.

Workarounds

If upgrading immediately is not possible, reject requests with Content-Encoding: gzip at a reverse proxy or load balancer, if your Fleet agents are not configured to compress requests.

Credits

We thank @fuzzztf for responsibly reporting this issue.

For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)

Join #fleet in osquery Slack