CVE-2026-44253 in Wazuh
Summary
by MITRE • 08/19/2026
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within Wazuh affects its cluster communication protocol, specifically impacting versions ranging from 3.9.0 through 4.14.5 as well as version 5.0.0-beta2. This security flaw resides in the core framework module responsible for handling inter-node communications, allowing an authenticated node to trigger a denial of service condition against the master cluster node. The root cause lies in insufficient input validation and resource management within the receive_str method found in the common.py file. When processing incoming messages, this function accepts a total size parameter provided by the sender without enforcing any maximum limits on the allocated memory buffer. Consequently, an attacker with valid authentication credentials for a cluster node can craft specific commands that request multi-gigabyte bytearrays to be allocated in memory.
The operational impact of this flaw is severe due to how Wazuh handles message fragmentation and buffering. The system retains divided-message fragments under unique counters within the div_msg_box structure without imposing any limits on the number of active fragments, their aggregate size, or expiration timers. This means that repeated requests for large data payloads will accumulate in memory as new_str commands are processed, while fragmented messages persist indefinitely if not properly cleaned up. As these allocations grow unchecked, they consume increasing amounts of system RAM until the master node exhausts its available memory resources. This resource exhaustion leads to a complete denial of service, disrupting agent connectivity and halting alert processing across the entire monitored environment, thereby compromising the availability aspect of the security triad for organizations relying on Wazuh for threat detection and response.
From a classification perspective, this vulnerability aligns with CWE-789: Memory Allocation with Excessive Size or Count, which describes flaws where software allocates more memory than intended due to insufficient validation of size parameters. Additionally, it relates to CWE-400: Uncontrolled Resource Consumption, as the lack of limits on buffer sizes and fragment retention leads to resource exhaustion. In terms of adversarial tactics, this exploit maps to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer attacks. The requirement for authentication indicates that an insider threat or a compromised node within the cluster would be necessary to initiate such an attack, highlighting the importance of strict access controls and network segmentation even among trusted internal components.
Mitigation strategies involve upgrading Wazuh to version 4.14.5 or later, where these limits have been implemented in the codebase to prevent unbounded memory allocation. For environments unable to upgrade immediately, administrators should enforce strict authentication policies for cluster nodes using strong credentials and mutual TLS certificates to ensure that only authorized components can communicate with the master node. Network segmentation can also be employed to restrict direct access between agent nodes and the master control plane, limiting the attack surface available to potential adversaries who may have compromised a lower-privilege endpoint. Regular monitoring of memory usage on cluster masters should be implemented to detect anomalous spikes that could indicate ongoing exploitation attempts before they result in service disruption.