Wazuh up to 4.14.5/5.0.0-beta1 Version Comparison src/shared/version_op.c compare_wazuh_versions denial of service

Summaryinfo

A vulnerability classified as critical has been found in Wazuh up to 4.14.5/5.0.0-beta1. Affected by this vulnerability is the function compare_wazuh_versions of the file src/shared/version_op.c of the component Version Comparison. This manipulation causes denial of service. This vulnerability is tracked as CVE-2026-45798. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Wazuh up to 4.14.5/5.0.0-beta1. It has been declared as critical. Affected by this vulnerability is the function compare_wazuh_versions of the file src/shared/version_op.c of the component Version Comparison. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-45798 since 05/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 4.14.6 or 5.0.0-beta2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 5.0.0-beta1

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion