Description

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T15:17:07.890Z",
  "pubdate": "2026-11-06T15:17:07.890Z",
  "executiveSummary": "A memory leak vulnerability has been identified within the generic JSON decoder of Wazuh Manager, affecting versions from 3.0.0 prior to 4.14.9.\nThis vulnerability is classified as an improper resource management issue that permits a remote attacker to induce an Out-of-Memory (OOM) condition.\nBy leveraging passwordless agent enrollment, an attacker can submit crafted events containing duplicate static JSON fields to the wazuh-analysisd daemon.\nThe sustained exploitation of this flaw leads to uncontrolled heap memory consumption, ultimately forcing an OOM kill of the process.\nThe primary impact is a persistent Denial of Service (DoS) resulting in the cessation of all security alerting and monitoring capabilities provided by the affected Wazuh Manager.\nExploitation requires the attacker to successfully enroll an agent, which is facilitated if passwordless enrollment is enabled, providing a path for unauthenticated or unauthorized agents to interact with the analysis pipeline.",
  "technicalDetails": "The vulnerability resides in the generic JSON decoding logic utilized by the wazuh-analysisd component of the Wazuh Manager. The root cause is a flaw in how the parser handles memory allocation when encountering repeated static fields within incoming event streams.\nWhen the Wazuh Manager receives JSON-formatted events, the decoder attempts to map key-value pairs into internal data structures. If an attacker submits a JSON payload containing duplicate keys (specifically static fields such as 'id'), the decoder's error handling and state management fail to properly release memory allocated for these duplicate or malformed entries.\nThe attack flow begins with the attacker utilizing passwordless enrollment to add a rogue agent to the Wazuh Manager infrastructure. Once authorized, the attacker transmits a continuous stream of specially crafted JSON events to the analysis daemon.\nEach event contains deliberately repetitive static fields designed to trigger the identified memory leak path. Because the decoder does not reclaim the memory associated with these redundant field allocations, each processed packet incrementally exhausts the available heap memory assigned to the wazuh-analysisd process.\nAs the process memory footprint grows, the operating system's OOM killer will eventually intervene to reclaim system resources, terminating the wazuh-analysisd daemon. This effectively disables the manager's capability to process, correlate, or alert on security events across the entire monitored environment.\nThe vulnerability is present in all Wazuh Manager versions starting from 3.0.0 up to, but not including, 4.14.9. The reliance on passwordless enrollment mechanisms significantly lowers the barrier to entry, as it allows attackers to establish a trusted communication channel with the manager without requiring complex credentials.\nThe post-exploitation state is characterized by a complete loss of visibility into the security posture of the infrastructure. Because the analysis pipeline is responsible for rule evaluation and alerting, the targeted termination of this service renders the SIEM platform ineffective, potentially masking additional malicious activity occurring simultaneously within the network."
}