CVE-2024-51461: IBM QRadar WinCollect Agent DOS Vulnerability

CVE-2024-51461 Overview

CVE-2024-51461 is a denial of service vulnerability in IBM QRadar WinCollect Agent versions 10.0 through 10.1.13. A remote attacker can interrupt an HTTP request to trigger uncontrolled memory consumption in the agent process. The underlying weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Successful exploitation degrades the availability of the WinCollect Agent, which forwards Windows event logs to IBM QRadar SIEM. Loss of log forwarding creates visibility gaps for security operations teams that depend on QRadar for identification and response.

Critical Impact
A network-based attacker can exhaust memory on hosts running vulnerable WinCollect Agents, disrupting Windows log collection into IBM QRadar.

Affected Products

IBM QRadar WinCollect Agent 10.0
IBM QRadar WinCollect Agent versions up to and including 10.1.13
Windows hosts running the affected agent versions

Discovery Timeline

2025-04-11 - CVE-2024-51461 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51461

Vulnerability Analysis

The flaw resides in HTTP request handling within the WinCollect Agent. When a client interrupts an in-progress HTTP request, the agent fails to release buffers and other allocated resources tied to the request. Repeated interrupted requests accumulate memory allocations that are never freed.

Over time, the process consumes available memory on the host. The condition qualifies as a resource exhaustion denial of service and does not expose or modify data. Exploitation requires user interaction, as reflected in the CVSS vector, but no authentication is required against the network-facing agent.

Root Cause

The root cause is missing throttling and cleanup logic for aborted HTTP transactions [CWE-770]. The agent allocates request-scoped memory before completing input validation and does not enforce a ceiling on outstanding or partial requests. Interrupted connections leave allocations orphaned in the process heap.

Attack Vector

An attacker with network reachability to the WinCollect Agent sends HTTP requests and terminates them before completion. Each aborted request adds to memory pressure on the target host. Sustained request-and-abort patterns exhaust available memory, causing the agent, and potentially co-located services, to fail.

No public proof-of-concept exploit is available for this issue. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the IBM Support advisory for vendor-provided technical detail.

Detection Methods for CVE-2024-51461

Indicators of Compromise

Sustained growth in the resident memory of the WinCollect Agent process on Windows hosts
High volume of short-lived or prematurely closed TCP connections to WinCollect listening ports
Gaps or delays in Windows event log delivery to IBM QRadar from affected collectors
WinCollect service crashes, restarts, or out-of-memory errors in the Windows Application event log

Detection Strategies

Baseline normal WinCollect memory and connection counts, then alert on deviations that exceed the baseline over a rolling window
Correlate WinCollect service restarts with spikes in inbound HTTP connections from unexpected source addresses
Monitor QRadar log source status for collectors that transition to error or warning states without a corresponding change window

Monitoring Recommendations

Enable Windows performance counters for the WinCollect process and forward them to a centralized monitoring system
Track network flow telemetry to WinCollect hosts and flag sources generating disproportionate half-open or reset connections
Alert on repeated log source health events in QRadar tied to WinCollect agents on the affected version range

How to Mitigate CVE-2024-51461

Immediate Actions Required

Inventory all Windows hosts running IBM QRadar WinCollect Agent and identify systems in the 10.0 through 10.1.13 range
Upgrade affected agents to a fixed version as specified in the IBM security bulletin
Restrict network access to WinCollect Agent listening ports to trusted QRadar management infrastructure only
Verify log source health in QRadar after remediation to confirm continued event ingestion

Patch Information

IBM has published remediation guidance in its support advisory at the IBM Support page for node 7230614. Apply the vendor-recommended WinCollect Agent update to close the resource exhaustion condition. Follow standard change control and validate agent-to-QRadar connectivity after upgrade.

Workarounds

Enforce host and network firewall rules that limit inbound HTTP traffic to WinCollect Agents to authorized QRadar consoles and event collectors
Deploy rate limiting or connection limits on network devices in front of WinCollect hosts to reduce the impact of aborted-request floods
Segment WinCollect Agents into a management VLAN that is not reachable from user or untrusted network segments

bash

# Example: restrict inbound access to WinCollect Agent using Windows Firewall
# Replace <QRadar-IP> with the authorized QRadar collector address
# and <WinCollect-Port> with the configured listening port
netsh advfirewall firewall add rule ^
    name="Allow QRadar to WinCollect" ^
    dir=in action=allow protocol=TCP ^
    localport=<WinCollect-Port> ^
    remoteip=<QRadar-IP>

netsh advfirewall firewall add rule ^
    name="Block Other WinCollect Inbound" ^
    dir=in action=block protocol=TCP ^
    localport=<WinCollect-Port>