CVE-2026-71540

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in Wazuh Cluster Protocol

Publication date: 2026-09-24

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget in affected versions, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-71540

EUVD

EUVD-2026-86333

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh-clusterd	From 3.9.0 (inc) to 4.14.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects Wazuh versions 3.9.0 to 4.14.7. It involves a flaw in wazuh-clusterd where a payload buffer is allocated based on a 20-byte header size before Fernet decryption validates the peer. An unauthenticated attacker can send a header declaring a payload up to 256 MiB, then stop sending data, causing the system to retain the large allocation until the connection closes. This can lead to excessive memory consumption and potential denial of service.

Detection Guidance

To detect this vulnerability, monitor network traffic on port 1516 (Wazuh cluster TCP listener) for connections that send only a 20-byte header without completing the payload. Check for unusually high memory usage in the wazuh-clusterd process or frequent OOM conditions. Use netstat or ss to inspect active connections to port 1516.

Impact Analysis

If exploited, this vulnerability can cause high memory usage on the Wazuh cluster node, potentially crashing the cluster process. This disrupts synchronization between nodes and may interrupt distributed API forwarding, leading to loss of security monitoring capabilities and reduced threat detection across the environment.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily affects the Wazuh cluster's memory management and availability. However, if the cluster process crashes due to memory exhaustion, it could disrupt security monitoring and incident response capabilities, potentially leading to non-compliance with data protection or security requirements that mandate continuous monitoring and logging.

Mitigation Strategies

Upgrade Wazuh to version 4.14.7 or later to address the memory allocation issue in wazuh-clusterd. Ensure no unauthenticated peers can access the cluster listener until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-71540. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70