CVE-2026-74046
Received Received - Intake

Wazuh Cluster Memory Exhaustion via Zip Bomb

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74046
EUVD
EUVD-2026-61077

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wazuh wazuh to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in Wazuh versions 4.4.0 through 4.14.6. It involves the fdecompress_files() function in cluster.py, which lacks proper size limits when decompressing peer-supplied archives. Attackers with a valid cluster Fernet key can upload a small, highly compressed zip bomb that forces the master node's wazuh-clusterd to decompress the payload into memory, causing memory exhaustion and service disruption.

Detection Guidance

Monitor wazuh-clusterd memory usage for sudden spikes during cluster synchronization. Check for errors in logs like 'Decompressed file exceeds the maximum allowed size' or OOM-killer events. Use commands like 'ps aux | grep wazuh-clusterd' to track process memory and 'dmesg | grep -i kill' to detect OOM events.

Impact Analysis

This vulnerability can lead to service disruption by exhausting memory on the master node's wazuh-clusterd service. Attackers can cause the system to run out of memory, potentially triggering the OOM killer and restarting the process. This disrupts cluster synchronization and may cause downtime for Wazuh services.

Mitigation Strategies
  • Upgrade Wazuh to version 4.14.7 or later to apply the fix for the decompression vulnerability.
  • Ensure the cluster Fernet key is not exposed or compromised to prevent exploitation.
  • Restrict network access to the cluster port (default TCP/1516) to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart