CVE-2026-77021: Checkmk agent receiver memory exhaustion via compressed data amplification

CVE-2026-77021 · Severity: info · Published 2026-09-21

Checkmk's agent receiver processes monitoring data from managed hosts using compression to reduce network traffic. An attacker controlling a host registered for push mode can send a small compressed payload that decompresses to an extremely large size, exhausting the receiver's memory and causing a denial of service. The vulnerability requires the attacker to have a valid host certificate for the push mode protocol.

Vendors: Checkmk.

Quick answers

Is CVE-2026-77021 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77021 being exploited in the wild.
How severe is CVE-2026-77021?
Informational severity, published 21 September 2026.
Which products and versions are affected?
Checkmk Cloud before 2.5.0p14, before 2.4.0p37, before 2.3.0p51; Checkmk Ultimate before 2.5.0p14, before 2.4.0p37, before 2.3.0p51, 2.2.0; Checkmk Ultimate MT before 2.5.0p14, before 2.4.0p37, before 2.3.0p51.
Is there a fix for CVE-2026-77021?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77021 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77021?
Check whether you run Checkmk Cloud, Checkmk Ultimate or Checkmk Ultimate MT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The agent receiver decompresses zlib-compressed agent data without enforcing a limit on the decompressed output size, allowing a zip bomb style attack where small payloads expand orders of magnitude. An authenticated attacker (one with a valid host certificate for push mode) can send specially crafted compressed data that causes memory exhaustion. The fix limits decompressed data to 512 MiB and rejects oversized payloads.

Affected products

  • Checkmk Checkmk Ultimate before 2.5.0p14, before 2.4.0p37, before 2.3.0p51, 2.2.0
  • Checkmk Checkmk Cloud before 2.5.0p14, before 2.4.0p37, before 2.3.0p51
  • Checkmk Checkmk Ultimate MT before 2.5.0p14, before 2.4.0p37, before 2.3.0p51

Timeline

  • 2026-09-21: disclosed: Public vulnerability disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.