fleet

Files

T

jacobshandling 0eb8d432bf Safely split incoming request headers, remove support for token presence in request body (#39427 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issues:**
- Prevents unbounded split length exploits similar to
https://nvd.nist.gov/vuln/detail/CVE-2025-30204
- Also removes parsing of request body for token, see
https://github.com/fleetdm/fleet/issues/39659
- @iansltx I figured since this PR updates the code blocks in question,
makes sense to [remove the body parsing
here](https://github.com/fleetdm/fleet/pull/39427/changes#diff-83b0d73af21e81cf2c5ed4448718d0760543699fe6e36e401372467befea29edL30-L33),
and clean up the [related dead
code](https://github.com/fleetdm/fleet/blob/c1e3e89b5fd1986f87b5ac227ae85dbdea18f074/frontend/services/entities/installers.ts#L13)
in a follow-up

See https://fleetdm.slack.com/archives/C019WG4GH0A/p1770322925865209

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

2026-02-18 08:50:04 -08:00

apple_bm

…

authz

Add new self-service auth method for iOS/iPadOS (#36659 )

2025-12-05 10:16:46 -05:00

capabilities

…

carvestore

Authenticate carve block endpoint before parsing the "data" field (#39353 )

2026-02-05 15:55:03 -03:00

certserial