Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44253: Wazuh cluster may run out of memory, stopping service

CVE-2026-44253 · published 2 months ago

Summary

Versions of Wazuh from 3.9.0 through 4.14.5 and the early 5.0 beta let a trusted cluster node ask for extremely large messages, causing the master node to consume all its memory. When memory is exhausted, the master can stop handling agents and alerts, disrupting monitoring. Upgrade to Wazuh 4.14.5 or later (or the 5.0.0 beta2 release) to apply the fix.

What to do

Update wazuh wazuh to version 4.14.5 or later.

Affected software

Vendor	Product	Affected versions
wazuh	wazuh	>= 3.9.0, < 4.14.5 5.0.0

Original advisory text

Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.

References

https://github.com/wazuh/wazuh/commit/d29c5c89a0e16477545ca27f4e06229021e3183c Patch
https://github.com/wazuh/wazuh/releases/tag/v4.14.5 URL
https://github.com/wazuh/wazuh/security/advisories/GHSA-h5r8-gvhv-cmp2 Vendor Advisory
https://github.com/wazuh/wazuh/pull/35173 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44253... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44253 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

CWE-789Memory Allocation with Excessive Size Value

Timeline

Published19 Aug 2026

Updated4 Nov 2026

First seen19 Aug 2026

Sources

CVE-2026-44253 · NVD

CVE-2026-44253 · MITRE

CVE-2026-44253 · OSV

GHSA-h5r8-gvhv-cmp2 · GHSA

Track software like this

Free during beta