Executive brief
Wazuh is an open-source security platform used for threat detection and incident response across corporate networks. A vulnerability in the system's cluster communication component allows an unauthenticated attacker to crash the service or cause significant performance degradation by exhausting the server's memory. This could disrupt security monitoring and automated response capabilities across the organization.
Technical details
A vulnerability exists in the Wazuh cluster protocol parser (specifically within the `wazuh-manager` package) due to uncontrolled resource consumption. The `get_info_from_header` method in the cluster's common framework trusts the 'total' length field provided in a message header before any authentication or decryption occurs. This value is passed directly to a `bytearray` allocation, allowing an unauthenticated attacker on an adjacent network to trigger massive memory allocations. By sending multiple crafted headers with large payload lengths, an attacker can exhaust system memory, leading to a Denial of Service (DoS) of the cluster service. The issue is fixed in version 4.14.5.
Affected products
- Wazuh Wazuh Manager >= 3.9.0, < 4.14.5
Timeline
- 2026-07-16: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: NVD publication date
- 2026-07-16: patched: Fix released in version 4.14.5