EUVD-2026-86333Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote peer triggers pre-validation allocation with low complexity and no interaction; impact is availability-only (process termination), no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget in affected versions, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.
AnalysisAI
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust process memory before any authentication takes place. In versions 3.9.0 through 4.14.6, the cluster protocol handler allocates a payload buffer sized directly from the peer-supplied 20-byte header - up to 256 MiB - and then simply stops sending, holding that allocation until the TCP connection closes; because Fernet decryption and peer validation only occur after the buffer is reserved, no valid cluster key is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires Wazuh deployed in cluster mode (multi-node) so that wazuh-clusterd is running and its cluster listener (default TCP 1516) is reachable by the attacker; the flaw is in the cluster protocol handler, so single-node deployments without the cluster listener are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Wazuh 4.14.7 or later, as documented in the release at https://github.com/wazuh/wazuh/releases/tag/v4.14.7 and detailed in advisory GHSA-78wx-4r6w-w73f (fix commit 9a996bc23d28725f6c1f8f7808355d90e20d3382, PR #37280); the patch removes pre-allocation on peer-controlled sizes, adds a 30-second pre-authentication payload deadline, and caps simultaneous connections at 10 per source IP. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Wazuh deployment to determine which managers run in cluster mode and whether the cluster listener on default TCP 1516 is reachable from anything other than trusted cluster peers; where it is more broadly reachable, immediately restrict access at the host firewall or network segmentation layer and confirm that cluster process memory and listener connection counts are being monitored so an exhaustion event is detected early. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attac
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today