Gzip Bomb Denial of Service in Fleet Server

Fleet versions before 4.83.0 are vulnerable to a denial of service attack where unauthenticated attackers exploit gzip decompression to exhaust server memory. By sending small, highly compressed request bodies to unauthenticated endpoints with the Content-Encoding: gzip header, attackers can trigger unbounded memory expansion during decompression, crashing the entire Fleet instance. This vulnerability is particularly dangerous because it requires no authentication, making any Fleet deployment accessible to attackers on the network. Organizations running vulnerable Fleet versions face service unavailability and potential data loss, affecting endpoint management and osquery-based security monitoring capabilities across their infrastructure.

While this CVE currently maps to zero Casky skills due to the absence of MITRE ATT&CK technique mappings, practitioners using Casky.ai's Claude-powered platform with extended reasoning would detect attack patterns associated with Resource Exhaustion and Denial of Service tactics. Security teams monitoring Fleet instances should leverage Casky's skill framework to establish detection rules around sudden memory consumption spikes, unusual gzip-encoded requests to unauthenticated endpoints, and abnormal request body sizes relative to decompressed payloads. By correlating network traffic patterns with system resource metrics through Claude's reasoning capabilities, practitioners can identify compression-based DoS attempts before they impact availability. Immediate mitigation requires upgrading to Fleet 4.83.0 or later and implementing request size limits and rate limiting on unauthenticated endpoints.