8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Fleet server may terminate unexpectedly when handling certain gRPC requests
Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint. This vulnerability impacts availability only. There is no exposure of sensitive data, no authentication bypass, no privilege escalation, and no integrity impact. Version 4.81.0 contains a patch. If upgrading immediately is not possible, the following mitigations can reduce exposure. Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges); deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required; and/or monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.
References
-
https://github.com/fleetdm/fleet/security/advisories/GHSA-x67p-9m2r-fxqv x_refsource_CONFIRM
-
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 x_refsource_MISC
Affected products
- ==< 4.81.0
Matching in nixpkgs
pkgs.fleet
CLI tool to launch Fleet server
pkgs.fleetctl
CLI tool for managing Fleet
pkgs.fleeting-plugin-aws
GitLab fleeting plugin for AWS
pkgs.azure-cli-extensions.fleet
Microsoft Azure Command-Line Tools Fleet Extension
pkgs.python312Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.python313Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.python314Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.haskellPackages.amazonka-iotfleethub
Amazon IoT Fleet Hub SDK
-
nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-25.11 2.0-unstable-2025-04-16
- nixos-25.11-small 2.0-unstable-2025-04-16
- nixpkgs-25.11-darwin 2.0-unstable-2025-04-16
pkgs.haskellPackages.amazonka-iotfleetwise
Amazon IoT FleetWise SDK
-
nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-25.11 2.0-unstable-2025-04-16
- nixos-25.11-small 2.0-unstable-2025-04-16
- nixpkgs-25.11-darwin 2.0-unstable-2025-04-16
pkgs.python312Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-25.11 boto3-iotfleethub-1.40.17
- nixos-25.11-small boto3-iotfleethub-1.40.17
- nixpkgs-25.11-darwin boto3-iotfleethub-1.40.17
pkgs.python313Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-unstable boto3-iotfleethub-1.40.17
- nixpkgs-unstable boto3-iotfleethub-1.40.17
- nixos-unstable-small boto3-iotfleethub-1.40.17
-
nixos-25.11 boto3-iotfleethub-1.40.17
- nixos-25.11-small boto3-iotfleethub-1.40.17
- nixpkgs-25.11-darwin boto3-iotfleethub-1.40.17
pkgs.python314Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-unstable boto3-iotfleethub-1.40.17
- nixpkgs-unstable boto3-iotfleethub-1.40.17
- nixos-unstable-small boto3-iotfleethub-1.40.17
pkgs.python312Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-25.11 boto3-iotfleetwise-1.41.0
- nixos-25.11-small boto3-iotfleetwise-1.41.0
- nixpkgs-25.11-darwin boto3-iotfleetwise-1.41.0
pkgs.python313Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-unstable boto3-iotfleetwise-1.43.0
- nixpkgs-unstable boto3-iotfleetwise-1.43.0
- nixos-unstable-small boto3-iotfleetwise-1.43.0
-
nixos-25.11 boto3-iotfleetwise-1.41.0
- nixos-25.11-small boto3-iotfleetwise-1.41.0
- nixpkgs-25.11-darwin boto3-iotfleetwise-1.41.0
pkgs.python314Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-unstable boto3-iotfleetwise-1.43.0
- nixpkgs-unstable boto3-iotfleetwise-1.43.0
- nixos-unstable-small boto3-iotfleetwise-1.43.0
pkgs.home-assistant-component-tests.tesla_fleet
Open source home automation that puts local control and privacy first
pkgs.python312Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
pkgs.python313Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
pkgs.python312Packages.types-aiobotocore-iotfleetwise
Type annotations for aiobotocore iotfleetwise
Package maintainers
-
@ulrikstrid Ulrik Strid <ulrik.strid@outlook.com>
-
@katexochen Paul Meyer <katexochen0@gmail.com>
-
@LeSuisse Thomas Gerbet <thomas@gerbet.me>
-
@asauzeau Antoine Sauzeau <antoine.sauzeau3@gmail.com>
-
@commiterate commiterate
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@mbalatsko Maksym Balatsko <mbalatsko@gmail.com>