Fleet before version 4.89.0 contains an unbounded recursion vulnerability in its Apple MDM enrollment property list parsing. An unauthenticated attacker can send a crafted binary plist payload of roughly 150 bytes to the enrollment endpoints, causing the server to perform exponential allocation or enter infinite recursion. This exhausts CPU and memory resources, ultimately crashing the Fleet server and denying service to legitimate users. The flaw is a classic instance of uncontrolled recursion, mapped to CWE‑674.

The affected product is Fleet by fleetdm, any installation using a firmware version earlier than 4.89.0. No other versions or products are currently known to be affected.

The CVSS score of 8.7 indicates a high severity DoS risk. No EPSS score is available, but the absence of a KEV listing suggests exploitation is not yet widely observed. The attack vector, inferred from the description, is unauthenticated traffic to the public Apple MDM enrollment endpoints; an attacker only needs to send the crafted plist to trigger the crash. Once the server is terminated, legitimate authentication and service operations cease until a restart or patch occurs.