An unauthenticated attacker can exploit unbounded reading of HTTP request bodies in Fleet prior to version 4.81.0, leading to excessive memory allocation and a denial‑of‑service condition. The weakness is a lack of input size enforcement, which corresponds to a memory exhaustion flaw and can be classified under CWE‑770. The primary impact is that legitimate users or services may become unavailable due to service slowdown or crash, while other aspects of the system remain unaffected.

The vulnerability affects the Fleet open‑source device management platform developed by fleetdm, specifically all unauthenticated HTTP endpoints before release 4.81.0. Users running any Fleet version less than 4.81.0 with exposed endpoints from the fleetdm: fleet product are susceptible.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, unauthenticated HTTP requests; an attacker merely needs network access to the vulnerable service to trigger the malicious payloads, making this vulnerability highly exploitable under suitable network conditions.