Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-19T16:17:10.833Z",
  "pubdate": "2026-08-19T16:17:10.833Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in the Wazuh cluster protocol within the framework/wazuh/core/cluster/common.py component of Wazuh versions 3.9.0 through 4.14.5 and 5.0.0-beta2. The flaw allows an authenticated cluster node to trigger uncontrolled memory consumption on the master node by sending specially crafted cluster communication payloads. Successful exploitation leads to severe resource exhaustion, resulting in the disruption of agent connectivity and alert processing capabilities across the monitored environment. The attack vector requires authentication within the Wazuh cluster network, granting an attacker the ability to continuously allocate memory without validation or restriction. Mitigation requires updating to the patched software versions 4.14.5 or 5.0.0-beta2.",
  "technicalDetails": "The vulnerability resides in the Wazuh cluster protocol implemented in framework/wazuh/core/cluster/common.py, specifically within the receive_str() method. The root cause is the lack of upper-bound validation on attacker-controlled total sizes specified for the InBuffer object. When a new_str command is processed, the method accepts an arbitrary, unvalidated size parameter, allowing an authenticated peer node to request the allocation of multi-gigabyte bytearray structures. Furthermore, these incoming byte arrays are repeatedly accumulated within the in_str buffer without any capping mechanism.\nIn addition to the unconstrained InBuffer allocation, the protocol's divided-message handling path retains message fragments designated as flag_divided under unique counters inside the div_msg_box structure. This mechanism completely lacks enforcement of a maximum count, aggregate size threshold, or expiration limit, enabling an adversary to flood the master node with persistent fragments that accumulate indefinitely in memory.\nThe attack flow proceeds as follows: an authenticated attacker situated within the Wazuh cluster initiates a communication session with the master node. The attacker crafts and transmits malicious cluster protocol commands, such as an oversized new_str command or a continuous stream of unvalidated flag_divided message fragments. The vulnerable receive_str() method parses these inputs and instantiates massive bytearray allocations or stores the fragments within div_msg_box without memory reclamation or boundary checks. As these requests are repeated, the master node's available system memory is rapidly depleted.\nThe exploitation prerequisites dictate that the attacker must have valid authentication credentials or node access within the Wazuh cluster architecture. The post-exploitation impact causes denial of service conditions on the cluster master, disrupting critical telemetry pipelines, real-time alert processing, and active agent connectivity across the entire monitored infrastructure."
}