CVE-2026-44253
MediumCVSS 4.9Summary
In Wazuh from version 3.9.0 to 4.14.5 and 5.0.0-beta2, the cluster protocol allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total without a maximum, and the divided-message path retains fragments without limits, potentially causing excessive memory consumption.
Risk Assessment
Exploitation can disrupt agent connectivity and alert processing across the monitored environment, potentially leading to security system outages.
Recommendation
Upgrade Wazuh to version 4.14.5 or 5.0.0-beta2 to address the memory exhaustion vulnerability.
Original NVD description (English source)
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.