CVE-2026-74046 in Manager
Summary
by MITRE • 08/18/2026
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Wazuh versions prior to 4.14.7 represents a critical denial of service flaw located within the cluster synchronization mechanism, specifically affecting the fdecompress_files function found in the cluster.py module. This issue stems from an insufficient input validation and resource management strategy when processing archive files submitted by authenticated peers for synchronization purposes. The core technical failure lies in the absence of constraints on the decompressed size during the extraction process. When a peer node sends a synchronization archive to the master node, the system proceeds to unpack the contents without verifying whether the total uncompressed data volume exceeds available memory resources or predefined safe thresholds. This design oversight allows an attacker who possesses valid cluster authentication credentials, such as a legitimate Fernet key used for secure communication between nodes, to exploit this logic gap by uploading specially crafted archives designed to maximize compression ratios while minimizing original file size.
The operational impact of this vulnerability is severe, primarily manifesting as resource exhaustion on the master node responsible for processing these synchronization requests. By submitting what appears to be a small archive that expands into a significantly larger payload upon decompression—a technique commonly known as a zip bomb—the attacker can force the wazuh-clusterd process to allocate excessive amounts of memory to hold the expanded data in RAM. Since there are no limits imposed on the size of the decompressed content, this unbounded allocation quickly consumes available system memory, leading to out-of-memory conditions that crash the cluster service or degrade its performance to the point of unavailability. This disruption effectively halts the collection and analysis of security events across the monitored environment, undermining the primary function of the Wazuh platform as a centralized monitoring and threat detection solution.
From a classification perspective, this vulnerability aligns with CWE-400, which describes conditions where resources are not properly limited before consumption, leading to resource exhaustion. It also relates closely to CWE-770, regarding allocation of resources without limits or thresholds, particularly in the context of memory management during file processing operations. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit technique falls under Denial of Service (T1499), specifically utilizing endpoint denial of service methods that involve overwhelming system resources to disrupt availability rather than compromising confidentiality or integrity directly. The requirement for authentication means this is not an unauthenticated remote code execution but rather a privilege-dependent attack vector targeting the stability and reliability of distributed security infrastructure components.
Mitigation strategies must focus on implementing strict resource controls within the cluster synchronization module. Developers should enforce hard limits on the maximum allowable size of decompressed archives, ensuring that any archive exceeding these thresholds is rejected before significant memory allocation occurs. Additionally, introducing rate limiting for file uploads from peer nodes can help mitigate the impact if such an attack vector persists in other contexts. For administrators operating vulnerable versions, immediate upgrading to Wazuh version 4.14.7 or later is required as this release includes patches addressing these resource management deficiencies. Until patching is complete, network-level controls restricting access to cluster synchronization endpoints and monitoring for anomalous memory usage patterns on master nodes can provide temporary operational resilience against exploitation attempts by insiders with valid credentials.