CVE-2026-112336

MEDIUM(6.5)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score21/100 — NIEDRIG

CVSS 6.5 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

Referenzen

https://github.com/wazuh/wazuh/commit/7fdd928228fa0478814277ab3e49bda9809cd50a
https://github.com/wazuh/wazuh/commit/c7df52ee8158577e7bd830e2b84d024612561f8b
https://github.com/wazuh/wazuh/releases/tag/v4.14.9
https://github.com/wazuh/wazuh/security/advisories/GHSA-6w6h-fwqm-6hjj
https://www.vulncheck.com/advisories/wazuh-manager-3.0.0-before-4.14.9-memory-le...