This vulnerability allows an unauthenticated attacker to trigger excessive memory consumption on the Fleet server by sending gzip‑compressed request bodies that expand dramatically when decoded. The server performs unbounded decompression without validating payload size, leading to resource exhaustion and eventual denial of service. The weakness is a classic unbounded buffer expansion (CWE‑409) that directly impacts availability.

Fleet instances deployed before version 4.83.0 are affected. All deployments of the fleetdm:fleet product earlier than 4.83.0 run the vulnerable code that lacks bounds checking for gzip payloads.

The CVSS score of 8.7 indicates significant severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only unauthenticated HTTP traffic to endpoints that accept gzip‑encoded bodies, so the attack surface is broad and the likelihood of exploitation is high in environments with exposed Fleet services.