CVE-2026-77021
Deferred Deferred - Pending Action

Memory Exhaustion in Checkmk via Zlib Compression

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Checkmk GmbH

Description
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-77021
EUVD
EUVD-2026-83883

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
checkmk checkmk to 2.5.0p14 (exc)
checkmk checkmk to 2.4.0p37 (exc)
checkmk checkmk to 2.3.0p51 (exc)
checkmk checkmk 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77021 is a data amplification vulnerability in Checkmk versions before 2.5.0p14, 2.4.0p37, 2.3.0p51, and 2.2.0 (EOL). It occurs when the agent receiver decompresses push agent data without enforcing a size limit. An attacker controlling a registered host can send a small zlib-compressed payload that decompresses to an arbitrary large size, potentially exhausting the agent receiver's memory.

Detection Guidance

To detect this vulnerability, monitor the agent receiver's memory usage and check for excessive decompression attempts. Look for error logs indicating payloads exceeding size limits. Checkmk versions affected are <2.5.0p14, <2.4.0p37, <2.3.0p51, and 2.2.0 (EOL).

Commands to check Checkmk version: grep '^VERSION' /omd/sites/*/etc/omd/site.conf or check the web interface under 'Help > About'. Monitor logs in /var/log/check_mk/web.log for decompression errors.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) conditions by crashing the agent receiver due to memory exhaustion. It requires an attacker to control a host registered for push mode, meaning they must already have some level of access to the system. The impact is limited to availability disruption rather than data theft or privilege escalation.

Compliance Impact

This vulnerability primarily affects system availability and could lead to service disruptions. While it does not directly impact data confidentiality or integrity, prolonged downtime could violate compliance requirements for availability in standards like GDPR or HIPAA. Organizations must ensure systems remain operational to meet regulatory obligations.

Mitigation Strategies

Immediately update Checkmk to a patched version: >=2.5.0p14, >=2.4.0p37, or >=2.3.0p51. No manual reconfiguration is needed after updating. Ensure all hosts registered for push mode are trusted, as exploitation requires control of such a host.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart