Approved changes feed: RSS · Atom
cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Fleetdm (c90559ff-e99d-5dcb-baa3-8cb06c3f587b) |
|---|---|
| Product | Fleet (1ef3f2c9-cafb-516a-b3da-382414f68308) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/fleetdm/fleet |
purl2cpe | 2026-10-12 21:12:08.908543 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-21296 |
vulnerable | 2026-06-08 05:29:11.566772 |
Denial-of-service in Fleet
LOW (2.7)
Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.
Published: 2021-02-10T20:00:19.000Z
Updated: 2024-08-03T18:09:15.667Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.