CVE-2026-33754
Received Received - Intake

Memory Exhaustion in Wazuh Cluster Protocol

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service of the cluster service. This issue has been fixed in version 4.14.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-33754

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wazuh wazuh-manager From 3.9.0 (inc) to 4.14.5 (exc)
wazuh wazuh-manager 4.14.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Wazuh allows a remote attacker to cause memory exhaustion by sending a specially crafted message header with an extremely large payload length. The parser allocates memory based on this length before authenticating or decrypting the message, leading to a denial of service (DoS) attack on the cluster service.

Detection Guidance

Monitor for unusual memory consumption or crashes in Wazuh cluster services. Check logs for repeated large payload length headers or failed memory allocations. Use network monitoring tools to detect abnormal traffic patterns targeting the cluster protocol port.

Impact Analysis

This vulnerability can cause system instability or crashes by exhausting available memory, disrupting the Wazuh cluster service. It requires no authentication or user interaction, making it exploitable from an adjacent network. The primary impact is reduced availability of the security monitoring system.

Compliance Impact

This vulnerability primarily impacts system availability by enabling unauthenticated denial of service (DoS) attacks through memory exhaustion. While not directly violating GDPR or HIPAA, such DoS conditions could disrupt services handling sensitive data, potentially leading to compliance issues if they impair access to protected information or fail to maintain system availability as required by these regulations.

Mitigation Strategies

Upgrade Wazuh-manager to version 4.14.5 or later immediately. If upgrading is not possible, restrict network access to the cluster protocol port to trusted sources only. Implement rate limiting or intrusion prevention systems to block malformed headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart