CVE-2026-74039
Received Received - Intake

Wazuh API Denial of Service via Nested JSON

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74039
EUVD
EUVD-2026-61075

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wazuh wazuh to 4.14.7 (exc)
wazuh wazuh to 5.0.0-beta2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74039 is a denial-of-service (DoS) vulnerability in Wazuh versions 4.0.0 to 5.0.0-beta2. Authenticated attackers with allow_run_as enabled can send deeply nested JSON payloads to the POST /security/user/authenticate/run_as endpoint. The API processes these payloads recursively without limits, consuming excessive CPU resources and blocking legitimate API users.

Detection Guidance

Monitor for unusually high CPU usage on Wazuh API servers, especially during authentication attempts. Check logs for repeated POST requests to /security/user/authenticate/run_as with deeply nested JSON payloads. Use tools like netstat or ss to inspect active connections to the Wazuh API port (typically 55000).

Commands to detect: 1) tail -f /var/ossec/logs/api.log | grep 'POST /security/user/authenticate/run_as' 2) ps aux | grep wazuh-api 3) ss -tulnp | grep 55000

Impact Analysis

This vulnerability can cause the Wazuh API to become unresponsive, blocking all authentication attempts and related API functions. Even a modest attack with 6 connections and a 1.89 MB payload can slow login times by 7.8x. Larger attacks may completely deny service to legitimate users.

Mitigation Strategies

Upgrade Wazuh to version 4.14.7 or later immediately. If upgrading is not possible, disable the allow_run_as feature for all users, particularly the wazuh-wui account. Implement network-level rate limiting on the Wazuh API port to prevent excessive requests.

Temporary mitigations: 1) Edit /var/ossec/etc/ossec.conf to set allow_run_as to false 2) Restart Wazuh manager with systemctl restart wazuh-manager 3) Configure firewall rules to block repeated requests from suspicious IPs

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74039. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart