CVE-2021-21296 Denial-of-service in Fleet

What is CVE-2021-21296?

CVE-2021-21296 is a low-severity denial of service vulnerability in fleetdm fleet, published on 10 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.

Weakness: CWE-400

Which versions are affected by CVE-2021-21296?

It affects 1 product.

Products include Fleetdm Fleet.

How do I fix CVE-2021-21296?

No fix has been published for CVE-2021-21296 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-21296 being exploited?

There is no known exploitation of CVE-2021-21296 in the wild and no public exploit code.

Other vulnerabilities in fleetdm fleet

• CVE-2020-26276 SAML authentication vulnerability in Fleet Critical 10.0
• CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers Critical 9.3
• CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment Critical 9.3
• CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests High 8.7
• CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xwh8-9p3f-3x45.