CVE-2026-44253
Received Received - Intake

Memory Exhaustion in Wazuh Cluster Protocol

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44253
EUVD
EUVD-2026-62552

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
wazuh wazuh 3.9.0
wazuh wazuh 4.14.5
wazuh wazuh 5.0.0-beta2
wazuh wazuh From 3.9.0 (inc) to 4.14.5 (exc)
wazuh wazuh 4.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44253 is a memory exhaustion vulnerability in Wazuh versions 3.9.0 to 4.14.4 and 5.0.0-beta2. It allows an authenticated cluster node to exhaust memory on the master node by sending attacker-controlled payloads. The receive_str() method accepts unbounded memory allocation requests, and divided-message fragments accumulate without limits. This disrupts agent connectivity and alert processing.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory usage or cluster communication anomalies in Wazuh. Check Wazuh manager logs for errors like WazuhClusterError (codes 3050 or 3051) indicating payload size violations or excessive divided messages. Use system monitoring tools like top, htop, or ps to observe abnormal memory consumption by the Wazuh manager process.

Impact Analysis

Exploitation can cause memory exhaustion on the Wazuh master node, leading to service disruption. This results in loss of agent connectivity and alert processing across the monitored environment. The master node may become unstable or crash, affecting the entire Wazuh deployment.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by disrupting the availability of Wazuh's monitoring and alert processing capabilities. Memory exhaustion on the master node may lead to loss of agent connectivity and delayed or missed security alerts, which are critical for detecting and responding to security incidents under these regulations.

Mitigation Strategies

Upgrade Wazuh to version 4.14.5 or 5.0.0-beta2 or later immediately. If upgrading is not possible, restrict cluster node access to trusted entities only and monitor cluster communication closely. Apply network-level protections to limit payload sizes and block fragmented message attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart