CVE-2026-44253: Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr() method accepts an attacker-controlled total for InBuffer without a maximum, so a newstr command can request a multi-gigabyte bytearray and repeated requests accumulate in instr. The divided-message path also retains flagdivided fragments under unique counters in divmsgbox without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.14.5 - Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh versions from 3.9.0 through 4.14.5, and 5.0.0-beta2, are identified as affected. The vulnerable component is the cluster protocol on the master, so exposure requires a deployment where an attacker can operate as an authenticated cluster node.
What access does an attacker need to cause the denial of service?
An attacker needs authenticated cluster-node access. They can send cluster protocol messages that request an unbounded receive buffer or retain divided-message fragments under unique counters, exhausting memory on the master.
What operational impact can exploitation have?
Memory exhaustion on the master can disrupt agent connectivity and alert processing across the monitored environment. The stated impact is denial of service rather than loss of confidentiality or integrity.
Which versions contain the fix?
The issue is fixed in Wazuh 4.14.5 and 5.0.0-beta2.