EUVD-2026-83883
GHSA-5q8h-fhcg-2395
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl host registered for push mode
-
DeliveryCraft small zlib decompression bomb
-
ExploitSend compressed payload to agent receiver
-
ExecutionUncapped inflation exhausts memory
-
ImpactAgent receiver OOM / monitoring DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Requires the attacker to control a host that is REGISTERED FOR PUSH MODE with the Checkmk agent receiver - i.e., an established, authorized push relationship (reflected as PR:L). Exploitation is not possible against pull-mode-only deployments or without an existing registered push host. The defect is the absence of a decompression size/ratio limit when the agent receiver processes zlib-compressed agent output. No user interaction is needed and the vector is network-reachable, but the registered-push-host requirement meaningfully limits the attacker population to insiders or already-compromised monitored hosts. Impact is confined to availability of the agent receiver (monitoring disruption); no data exposure or code execution. |
| Impact | This is a genuinely lower-tier issue despite being a real, confirmed flaw. The vendor CVSS 4.0 vector (5.3, Medium) has VA:L and no confidentiality/integrity impact, correctly capturing a pure availability defect (CWE-409 data amplification / zip bomb). The critical gating factor is PR:L combined with a very specific precondition: the attacker must already control a host that is REGISTERED FOR PUSH MODE with the Checkmk agent receiver - this is not open, unauthenticated internet exposure. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is not demonstrated. I assess the vendor slightly understated impact: exhausting the memory of the agent receiver via unbounded decompression is a full OOM condition, so availability impact is better modeled as A:H/VA:H rather than VA:L - but this raises severity only modestly and does not change the priority tier. Net: real but low-priority; patch on normal cadence unless push mode is widely used with semi-trusted hosts. Note the input Tag 'Information Disclosure' directly conflicts with the CVSS vector (VC:N/VI:N, only VA set) - this is a DoS/availability issue, not disclosure. |
| Exploit ScenarioDerived | An attacker who has compromised or controls a monitored host that is registered for Checkmk push mode crafts a tiny zlib-compressed payload engineered to inflate to an enormous size on decompression. The agent receiver decompresses it without a size cap, exhausting available memory and disrupting monitoring for the site. No public exploit code is identified, but the technique (classic decompression bomb) is well understood and trivial to construct. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Memory exhaustion in the Checkmk agent receiver lets an attacker who controls a host registered for push mode send a tiny zlib-compressed payload that expands to an arbitrary size, consuming receiver memory and disrupting monitoring. Affected releases are Checkmk before 2.5.0p14, before 2.4.0p37, and before 2.3.0p51, plus the end-of-life 2.2.0 branch. No public exploit identified at time of analysis, and exploitation is gated by an established, authorized push-mode registration (authenticated per the PR:L vector), so realistic attackers are insiders or already-compromised monitored hosts; impact is limited to availability of the agent receiver with no data exposure or code execution.
RemediationAI
Upgrade to a fixed maintenance release: 2.5.0p14, 2.4.0p37, or 2.3.0p51, per the vendor advisory at https://checkmk.com/werk/22116. Because 2.2.0 is end-of-life and will never receive a patch, sites still running it must migrate to a supported branch (2.3 or newer) rather than wait for a backport. Where immediate upgrade is not possible, the most effective compensating control is to reduce the exposed attacker population by deregistering push hosts that are no longer needed and by restricting network reachability of the agent receiver to only the hosts that legitimately push data, accepting the operational cost of re-registering or re-addressing hosts as they move. Placing the agent receiver under a hard memory cgroup or container limit converts unbounded growth into an out-of-memory kill, which preserves the rest of the appliance but causes the monitoring disruption the flaw intends; this is a trade-off, not a fix. Monitoring receiver memory growth and alerting on abnormal per-host payload size can shorten detection time but does not prevent the exhaustion itself. Restricting receiver access is not viable for push-mode deployments that must accept agent output from many hosts, so patch-level remediation remains the primary path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-409 (Improper Handling of Highly Compressed Data / data amplification), the classic decompression-bomb class. Checkmk's agent receiver accepts agent output from hosts registered in push mode, and that output may be zlib-compressed; the receiver decompresses it without enforcing a size or compression-ratio limit, so a small request body can be inflated into an arbitrarily large in-memory buffer and exhaust available memory. The CPE string cpe:2.3:a:checkmk_gmbh:checkmk:*:*:*:*:*:*:*:* is version-agnostic, so the precise affected scope comes from the vendor advisory, which fixes the 2.5, 2.4, and 2.3 maintenance branches and declares 2.2.0 end-of-life. The vendor-supplied CVSS 4.0 score is 5.3 with PR:L, and the independent assessment agrees on the prerequisite (a registered push host) while scoring the availability impact higher under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because a successful payload can render the receiver unusable and halt monitoring data ingestion. The distinguishing characteristic is amplification: negligible attacker bandwidth and payload size versus a large, receiver-side memory commitment, and the absence of any state-changing or information-leaking primitive.
Know when Checkmk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable receiver, low complexity, but requires an authorized registered push host (PR:L); memory exhaustion is a full OOM so A:H, with no confidentiality or integrity impact.
Primary rating from Vendor (Checkmk).
CVSS VectorVendor: Checkmk
Lifecycle Timeline
1DescriptionCVE.org
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Local privilege escalation in the Checkmk Windows Agent's Windows License plugin allows an authenticated low-privileged
Stored/transmitted cross-site scripting in Checkmk's distributed monitoring lets an attacker who already controls a remo
Authenticated path traversal in Checkmk's report scheduler lets a user with valid application credentials write report f
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrar
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8
Exploit-DB