CVE-2026-61811: Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the getattributes() function in src/osxml/osxml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Wazuh versions from 3.8.0 through versions before 4.14.7 are affected. Exploitation targets analysisd worker threads handling Windows EventChannel events from enrolled agents.
What access does an attacker need to trigger the issue?
An attacker needs privileges equivalent to an enrolled agent that can submit a crafted Windows EventChannel event. No user interaction is required, and the supplied vector is network-accessible.
Does the XML element-depth limit prevent exploitation?
No. The existing limit in _ReadElem() restricts element depth, but it does not limit how many attributes a single XML element contains.
What is the operational impact of a successful attack?
A crafted element with sufficiently many attributes can exhaust an analysisd worker-thread stack and cause a segmentation fault. This interrupts log ingestion.
What remediation is available?
Upgrade Wazuh to version 4.14.7, which fixes the issue.