This vulnerability in the open source Fleet Device Management software allows an attacker to send arbitrarily large or repeated request bodies to unauthenticated HTTP endpoints. Because the application does not enforce a size limit when reading the request body, the process may allocate excessive memory, eventually exhausting resources and causing the service to become unresponsive. The flaw is classified as CWE-770: Uncontrolled Resource Consumption.

All versions of the Fleet product before 4.81.0 are affected. The issue applies to the default configuration where the vulnerable endpoints are publicly accessible without authentication. The public advisory reports that sending large or multiple payloads can trigger a denial‑of‑service condition.

The CVSS score is 8.7, indicating high severity, while the EPSS score is below 1%, suggesting that exploitation is not yet widespread. The vulnerability is not listed in the CISA KEV catalog, so no active exploits are known. Attackers can remotely send oversized payloads without authentication, making the attack straightforward. Although the exploitation probability is low, the impact of a successful denial‑of service could disrupt device management operations in critical environments.