# CVE-2026-61811: Wazuh stack exhaustion in XML parser via element attributes

Source: https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61811 · Severity: medium · CVSS 6.5 · Published 2026-09-24

Wazuh, an open-source security and threat detection platform, contains a flaw in its XML parser that allows authenticated agents to crash the analysis service. An attacker can submit a malicious Windows event containing an XML element with excessive attributes, causing the service to run out of memory and stop processing logs, creating a denial of service condition.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-61811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61811 being exploited in the wild.

**How severe is CVE-2026-61811?** Medium severity, with a CVSS score of 6.5, published 24 September 2026.

**Which products and versions are affected?** Wazuh 3.8.0 to 4.14.6.

**Is there a fix for CVE-2026-61811?** A patch was published on 2026-06-24: Fixed in version 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61811 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61811?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The _getattributes() function in src/os_xml/os_xml.c recursively processes XML attributes without a depth limit while allocating large local buffers on the stack for each attribute, allowing an enrolled agent to trigger stack exhaustion. The element-depth limit in _ReadElem() does not constrain the number of attributes per element, so the existing safeguard does not prevent this condition. Exploitation requires agent enrollment and submission of a specially crafted Windows EventChannel event, resulting in segmentation fault of the analysisd worker thread and interruption of log ingestion.

## Affected products

- Wazuh Wazuh 3.8.0 to 4.14.6

## Timeline

- 2026-09-24: disclosed
- 2026-06-24: patched: Fixed in version 4.14.7

## References

- [https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67](https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67)
- [https://github.com/wazuh/wazuh/pull/37147](https://github.com/wazuh/wazuh/pull/37147)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)
- [Wazuh authentication bypass in config masking via RBAC](https://junglewise.ai/threats/cve-2026-61783-wazuh-authentication-bypass-in-config-masking-via-rbac)