Description

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-18T18:19:34.053Z",
  "pubdate": "2026-08-18T18:19:34.053Z",
  "executiveSummary": "Wazuh versions 4.4.0 prior to 4.14.7 contain a denial of service vulnerability involving improper handling of compressed synchronization archives.\nThe vulnerability allows authenticated cluster peers to cause memory exhaustion on the master node by supplying a malicious archive.\nThe flaw specifically affects the fdecompress_files() function within cluster.py, which processes incoming synchronization archives without enforcing decompressed size limits.\nAn attacker possessing a valid cluster Fernet key can exploit this vulnerability by uploading a specially crafted zip bomb archive.\nWhen processed by wazuh-clusterd on the master node, the high compression ratio forces the system to allocate excessive memory during decompression.\nThis resource exhaustion leads to service disruption, rendering the master node unresponsive.\nExploitation requires valid cluster authentication credentials in the form of the cluster Fernet key, limiting the attack vector to authenticated cluster participants.",
  "technicalDetails": "The vulnerability resides in the fdecompress_files() function located in cluster.py within the Wazuh clustering module.\nThe vulnerable component handles the decompression of synchronization archives received from cluster peers during routine cluster communication and state synchronization operations.\nThe root cause of the vulnerability is the absence of decompressed size limits or validation checks prior to processing archive payloads within fdecompress_files().\nAffected versions include Wazuh 4.4.0 up to, but not including, 4.14.7.\nPrerequisites for successful exploitation include valid authentication within the Wazuh cluster, specifically requiring possession of a valid cluster Fernet key used to encrypt and decrypt cluster communications.\nThe attack flow begins with an authenticated attacker, or a compromised cluster peer holding the valid cluster Fernet key, generating a malicious synchronization archive.\nThis payload takes the form of a highly compressed zip bomb file designed to be exceptionally small in its compressed state while expanding exponentially upon extraction.\nThe attacker transmits this synchronization archive to the Wazuh master node over the cluster communication protocol.\nUpon receipt, the wazuh-clusterd daemon on the master node invokes fdecompress_files() to process the incoming archive.\nBecause the function lacks checks for the uncompressed data size, it attempts to decompress the entire payload into the system memory.\nThe massive expansion of the zip bomb consumes all available system memory resources on the master node.\nThis memory exhaustion directly results in a denial of service, causing the wazuh-clusterd service to crash or become entirely unresponsive, thereby disrupting cluster operations and overall log analysis capabilities."
}