CVE-2026-77021: Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Checkmk agent receivers are exposed when running versions earlier than 2.5.0p14, 2.4.0p37, or 2.3.0p51. Version 2.2.0 is also affected and is end of life.
What access does an attacker need to trigger memory exhaustion?
The attacker must control a host that is registered for push mode. They can then send a small zlib-compressed agent payload that expands to an arbitrary size when processed by the agent receiver.
What is the impact of successful exploitation?
An attacker can exhaust memory on the agent receiver through decompression amplification. The issue concerns resource exhaustion rather than data exposure or modification.