CVE-2026-74046: Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh cluster package (wazuh-clusterd)to a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Which systems are exposed?
The affected releases are Wazuh 4.4.0 through versions before 4.14.7. The exposed component is wazuh-clusterd on the master node during cluster synchronization.
What access is required to exploit this issue?
An attacker needs a valid cluster Fernet key and authenticated cluster-peer access. No user interaction is required, and the attacker can submit a small compressed archive that expands in memory on the master.
What should be done if patching cannot happen immediately?
Upgrade to Wazuh 4.14.7 or later. If an upgrade cannot be performed immediately, restrict cluster-peer access and protect or rotate cluster Fernet keys to prevent untrusted parties from authenticating as cluster nodes.