Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-44251: Wazuh manager can be stopped by a crafted agent message
CVE-2026-44251 · published 3 months ago
Summary
Wazuh versions from 3.0.0 up to 4.14.4 allow a specially crafted message from a registered agent to crash the wazuh‑remoted service on the manager, which disconnects all agents. The same flaw could also corrupt the manager’s memory. Upgrade to Wazuh 4.14.5 or later to fix the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wazuh | wazuh | >= 3.0.0, < 4.14.5 |
Original advisory text
Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents from the manager. A second code path reached by the same underflow may allow heap memory corruption. This issue has been fixed in version 4.14.5.
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5r-5p7c-g9fq Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44251... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44251 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-122Heap-based Buffer Overflow
CWE-191Integer Underflow (Wrap or Wraparound)
Timeline
Published17 Jul 2026
Updated4 Nov 2026
First seen17 Jul 2026
Track software like this
Free during beta