What is the CVSS score of CVE-2026-33754?

CVE-2026-33754 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Wazuh CVE-2026-33754

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-17 security-advisories@github.com

Denial Of Service Wazuh

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AV:A confirmed by cluster-protocol adjacency requirement; PR:N because authentication check occurs after the vulnerable memory allocation; C:N/I:N as only availability is impacted.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 00:29 vuln.today

DescriptionCVE.org

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service of the cluster service. This issue has been fixed in version 4.14.5.

AnalysisAI

Memory exhaustion denial-of-service in Wazuh's cluster protocol parser affects all deployments running versions 3.9.0 through 4.14.4. The cluster service reads an attacker-supplied payload length from an incoming message header and allocates memory of that size before performing any authentication or decryption, enabling unauthenticated adjacent-network attackers to exhaust system memory and crash the cluster service. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch 4.14.5 is available.

Technical ContextAI

Wazuh is an open-source SIEM and XDR platform whose multi-node cluster mode uses a proprietary binary TCP protocol for inter-manager communication. The cluster protocol parser reads a length field from an incoming message header and immediately performs a memory allocation of that claimed size before decrypting or authenticating the message - a textbook CWE-400 (Uncontrolled Resource Consumption) pattern. Because the trust boundary is crossed prior to any credential verification, an unauthenticated peer that can reach the cluster port (typically TCP 1516) can advertise an arbitrarily large payload length, forcing the process to attempt an equally large allocation and rapidly consuming available system memory. No CPE string was provided in the advisory data; affected product range is Wazuh manager 3.9.0 through 4.14.4 inclusive, as confirmed by GitHub Security Advisory GHSA-476v-28pp-5wg9.

RemediationAI

Upgrade to Wazuh 4.14.5, which resolves the issue per the vendor security advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-476v-28pp-5wg9. As a compensating control prior to patching, restrict network access to the Wazuh cluster communication port (default TCP 1516) using host-based firewall rules or network ACLs so that only the IP addresses of legitimate Wazuh manager cluster peers can reach it - the AV:A adjacency requirement means access control is the most effective interim mitigation and introduces no functional side effects for properly segmented deployments. Single-node Wazuh deployments that do not use cluster mode should verify whether the cluster listener is active and, if not needed, disable it entirely to eliminate the attack surface.