CVE-2026-33754: Wazuh Denial of Service Vulnerability

CVE-2026-33754 Overview

CVE-2026-33754 is a memory exhaustion vulnerability in Wazuh, the open source threat prevention, detection, and response platform. The flaw affects the cluster protocol parser in versions 3.9.0 through versions prior to 4.14.5. A remote attacker on an adjacent network can send a crafted message header declaring an arbitrarily large payload length. The parser trusts this length field before authentication or decryption and uses it directly to allocate memory. The result is unauthenticated denial of service against the Wazuh cluster service. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and has been fixed in version 4.14.5.

Critical Impact
Unauthenticated attackers with adjacent network access can exhaust memory on Wazuh cluster nodes, disrupting threat detection and response operations.

Affected Products

Wazuh versions 3.9.0 through 4.14.4
Wazuh cluster service components processing cluster protocol messages
Deployments where the cluster port is reachable from adjacent networks

Discovery Timeline

2026-07-17 - CVE-2026-33754 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-33754

Vulnerability Analysis

The vulnerability resides in the Wazuh cluster protocol parser. Cluster nodes exchange messages framed with a header that includes a payload length field. The parser reads this length from the untrusted header and uses it as an allocation size before validating the sender or decrypting the payload. An attacker can set the length field to an arbitrarily large value, forcing the target node to attempt a very large memory allocation. Repeated crafted messages exhaust available memory and crash the cluster service. No credentials, keys, or prior authentication are required. Because the length check occurs before cryptographic validation, standard cluster authentication does not mitigate the issue.

Root Cause

The root cause is trusting attacker-controlled length values from an unauthenticated protocol header. The parser lacks a maximum size bound and performs allocation before verifying message integrity. This ordering violates the principle of validating message authenticity before committing resources, resulting in uncontrolled resource consumption ([CWE-400]).

Attack Vector

Exploitation requires network reachability to the Wazuh cluster port on a target node. The attacker sends a small crafted message whose header declares a very large payload length. The daemon attempts to allocate the declared size, consuming memory and eventually terminating or destabilizing the service. Repeated messages amplify the impact. The attack does not require agent registration or valid cluster keys. See the Wazuh GitHub Security Advisory GHSA-476v-28pp-5wg9 for vendor detail.

Detection Methods for CVE-2026-33754

Indicators of Compromise

Unexpected termination or restart of the wazuh-clusterd process on manager nodes
Sudden spikes in resident memory usage on Wazuh cluster nodes followed by out-of-memory events
Inbound connections to the cluster port from hosts that are not authorized cluster peers
Cluster log entries showing malformed or oversized message headers

Detection Strategies

Monitor wazuh-clusterd logs for parser errors, allocation failures, and abrupt shutdowns
Baseline normal cluster message sizes and alert on headers declaring payloads well beyond that baseline
Correlate OOM killer events in system logs with Wazuh cluster process identifiers
Track TCP connections to the cluster port from source addresses outside the defined cluster peer list

Monitoring Recommendations

Enable host-level memory and process telemetry on all Wazuh manager nodes
Forward wazuh-clusterd logs to a central log store for anomaly analysis
Alert on repeated connection attempts to the cluster port from unexpected sources
Review network flow data for unusual traffic patterns targeting cluster ports on adjacent subnets

How to Mitigate CVE-2026-33754

Immediate Actions Required

Upgrade all Wazuh manager and cluster nodes to version 4.14.5 or later
Restrict access to the Wazuh cluster port using host firewalls or network access control lists
Ensure the cluster interface is not exposed to untrusted networks or the public internet
Audit the list of hosts able to reach the cluster port and remove any that are not authorized peers

Patch Information

Wazuh addressed the vulnerability in version 4.14.5. The fix enforces sanity limits on the payload length declared in the cluster protocol header before memory allocation occurs. Refer to the Wazuh GitHub Security Advisory GHSA-476v-28pp-5wg9 for release details and upgrade guidance.

Workarounds

Isolate cluster traffic on a dedicated management VLAN accessible only to authorized cluster nodes
Apply firewall rules that permit the cluster port only from known peer IP addresses
Monitor and rate-limit new connections to the cluster port at the network boundary
If upgrade is not immediately possible, run cluster nodes with strict process memory limits to contain impact

bash

# Example iptables rules restricting the Wazuh cluster port (default 1516)
# to a defined list of authorized cluster peers
iptables -A INPUT -p tcp --dport 1516 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 1516 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 1516 -j DROP