CVE-2026-112336: Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh Managerto a version that resolves this vulnerability.Fixed in 4.14.9
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh Manager versions from 3.0.0 up to, but not including, 4.14.9 are affected. The vulnerable component is wazuh-analysisd's generic JSON decoder.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to enroll a Wazuh agent through passwordless enrollment. They can then repeatedly send events containing duplicate static fields, such as id.
What is the operational impact of successful exploitation?
Repeated malicious events can exhaust memory used by wazuh-analysisd and cause an out-of-memory kill. This disables alerting.