# CVE-2026-74046: Wazuh denial of service via decompression bomb in cluster archive processing

Source: https://junglewise.ai/threats/cve-2026-74046-wazuh-denial-of-service-via-decompression-bomb-in-cluster-archive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74046 · Severity: medium · CVSS 4.9 · Published 2026-08-18

Wazuh, an open-source security monitoring platform used to collect and analyze logs across enterprise infrastructure, contains a flaw that allows authenticated cluster members to cause memory exhaustion on the master node. An attacker with the cluster encryption key can upload a specially crafted compressed archive that decompresses to a very large size in memory, overwhelming the master node and disrupting security monitoring operations.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh), [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-74046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74046 being exploited in the wild.

**How severe is CVE-2026-74046?** Medium severity, with a CVSS score of 4.9, published 18 August 2026.

**Which products and versions are affected?** Wazuh Manager 4.4.0 before 4.14.7.

**Is there a fix for CVE-2026-74046?** A patch was published on 2026-06-25: Fix merged in PR #37119 to 4.14.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74046 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-74046?** Check whether you run Wazuh or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a decompression bomb attack in the fdecompress_files() function (cluster.py, lines 490–510). The receiver calls zlib.decompress(content) on each archive member without enforcing a maximum decompressed size, allowing an authenticated peer to upload a small, highly compressed payload that expands to gigabytes in memory. The attack requires a valid cluster Fernet key and network access to the master cluster port (default TCP/1516). An attacker can achieve a compression amplification ratio of roughly 1000:1, causing a 510 KB wire input to allocate 1+ GiB transient heap on the master node and trigger denial of service through memory exhaustion. The fix (merged in PR #37119) bounds the decompressed size during sync archive processing.

## Affected products

- Wazuh wazuh-manager 4.4.0 before 4.14.7

## Timeline

- 2026-08-18: disclosed: CVE-2026-74046 published; GHSA-mr7j-w2m4-vw5j advisory released
- 2026-06-25: patched: Fix merged in PR #37119 to 4.14.7
- 2026-08-18: other: Advisory published after patch availability

## References

- [https://github.com/wazuh/wazuh/pull/37119](https://github.com/wazuh/wazuh/pull/37119)
- [https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j](https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j)

## Related threats

- [Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection)
- [Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname)
- [Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request)
- [Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak)
- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)