Executive brief
Wazuh, an open-source security monitoring platform used to collect and analyze logs across enterprise infrastructure, contains a flaw that allows authenticated cluster members to cause memory exhaustion on the master node. An attacker with the cluster encryption key can upload a specially crafted compressed archive that decompresses to a very large size in memory, overwhelming the master node and disrupting security monitoring operations.
Technical details
The vulnerability is a decompression bomb attack in the fdecompress_files() function (cluster.py, lines 490–510). The receiver calls zlib.decompress(content) on each archive member without enforcing a maximum decompressed size, allowing an authenticated peer to upload a small, highly compressed payload that expands to gigabytes in memory. The attack requires a valid cluster Fernet key and network access to the master cluster port (default TCP/1516). An attacker can achieve a compression amplification ratio of roughly 1000:1, causing a 510 KB wire input to allocate 1+ GiB transient heap on the master node and trigger denial of service through memory exhaustion. The fix (merged in PR #37119) bounds the decompressed size during sync archive processing.
Affected products
- Wazuh wazuh-manager 4.4.0 before 4.14.7
Timeline
- 2026-08-18: disclosed: CVE-2026-74046 published; GHSA-mr7j-w2m4-vw5j advisory released
- 2026-06-25: patched: Fix merged in PR #37119 to 4.14.7
- 2026-08-18: other: Advisory published after patch availability