CVE-2026-44253: Wazuh Cluster Protocol DoS Vulnerability

CVE-2026-44253 Overview

CVE-2026-44253 is a resource exhaustion vulnerability [CWE-770] affecting the Wazuh open-source threat detection and response platform. The flaw resides in the cluster protocol implementation at framework/wazuh/core/cluster/common.py. An authenticated cluster node can exhaust memory on the master node by abusing the receive_str() method, which accepts an attacker-controlled total size for InBuffer without any upper bound. Repeated new_str commands accumulate multi-gigabyte allocations in in_str, while the divided-message path retains fragments in div_msg_box without count, size, or expiration limits. The vulnerability affects Wazuh versions from 3.9.0 through 4.14.4 and 5.0.0-beta1.

Critical Impact
Successful exploitation disrupts agent connectivity and alert processing across the monitored environment, undermining threat detection capabilities.

Affected Products

Wazuh versions 3.9.0 through 4.14.4
Wazuh 5.0.0-beta1
Wazuh cluster master node deployments

Discovery Timeline

2026-08-19 - CVE-2026-44253 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-44253

Vulnerability Analysis

The vulnerability stems from missing size and resource limits in Wazuh's inter-node cluster communication protocol. When a cluster worker sends a new_str command to the master, the master allocates an InBuffer bytearray sized according to attacker-supplied metadata. No maximum threshold enforces a reasonable ceiling.

An authenticated node can request a multi-gigabyte buffer per message. Repeated requests compound the memory pressure since allocations persist in the in_str dictionary. The divided-message code path adds a second vector: fragments flagged with flag_divided are stored under unique counter keys in div_msg_box with no aggregate size cap, no fragment count limit, and no expiration policy.

The result is unbounded memory growth on the master node until the operating system kills the Wazuh process or the host becomes unresponsive. Agent connectivity and alert processing halt across the monitored fleet.

Root Cause

The root cause is missing input validation and resource allocation limits [CWE-770] in the cluster receive logic. The receive_str() method trusts the sender-supplied length field, and the divided-message handler lacks bookkeeping to reject or evict stale fragments. This design assumes all cluster peers are cooperative, which fails once any node is compromised or a malicious worker joins.

Attack Vector

Exploitation requires authenticated access as a cluster node. The attacker sends crafted new_str messages requesting large InBuffer allocations or floods the master with divided-message fragments carrying unique counter values. The master accumulates memory until exhaustion.

python

         3047: "Invalid HAProxy Dataplane API specification configured",
         3048: "Could not detect a valid HAProxy process linked to the Dataplane API",
         3049: "Unexpected response from HAProxy Dataplane API",
+        3050: "Payload size exceeds maximum allowed limit",
+        3051: "Too many concurrent divided messages",

         # RBAC exceptions
         # The messages of these exceptions are provisional until the RBAC documentation is published.

Source: Wazuh commit d29c5c8. The patch introduces two new exception codes (3050 and 3051) that enforce payload size limits and concurrent divided-message caps.

Detection Methods for CVE-2026-44253

Indicators of Compromise

Sudden and sustained memory growth in the Wazuh master node process (wazuh-clusterd) without a corresponding increase in monitored endpoints.
Repeated new_str cluster commands from a single worker node with abnormally large size fields.
Rapid accumulation of entries in the master's div_msg_box structure with unique, non-completing counter values.
Loss of agent connectivity and alert ingestion stalls following memory spikes on the cluster master.

Detection Strategies

Monitor resident memory of the Wazuh master daemon and alert when growth exceeds baselines by a defined threshold.
Enable verbose cluster protocol logging to capture message sizes and originating worker identifiers.
Correlate cluster worker authentication events with subsequent memory pressure on the master.

Monitoring Recommendations

Track process-level RSS and virtual memory for wazuh-clusterd and configure OS-level OOM alerts.
Instrument cluster node join and rekey events for anomaly review, especially from unexpected source IPs.
Alert on Wazuh agent disconnection storms that follow master-node resource anomalies.

How to Mitigate CVE-2026-44253

Immediate Actions Required

Upgrade Wazuh cluster deployments to version 4.14.5 or 5.0.0-beta2, which enforce payload size and divided-message limits.
Restrict cluster protocol network access to trusted management interfaces only using firewall rules or private VLANs.
Rotate cluster authentication keys and audit which nodes are authorized to join the cluster.

Patch Information

The vulnerability is fixed in Wazuh 4.14.5 and 5.0.0-beta2. The patch adds error codes 3050 ("Payload size exceeds maximum allowed limit") and 3051 ("Too many concurrent divided messages") to reject oversized buffers and cap concurrent divided-message state. See the Wazuh Security Advisory GHSA-h5r8-gvhv-cmp2, the remediation pull request #35173, and the v4.14.5 release notes.

Workarounds

Isolate the cluster protocol port (default 1516/tcp) so only known master and worker hosts can connect.
Enforce network-layer rate limiting on inter-node traffic to slow exploitation attempts until patching completes.
Deploy host-level memory quotas or systemd MemoryMax limits on the Wazuh master service to trigger controlled restarts instead of full host exhaustion.

bash

# Restrict Wazuh cluster port to trusted worker subnet
sudo iptables -A INPUT -p tcp --dport 1516 -s 10.0.10.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 1516 -j DROP

# Apply a memory cap via systemd override to contain runaway allocation
sudo systemctl edit wazuh-manager
# Add the following to the override file:
# [Service]
# MemoryMax=8G
sudo systemctl daemon-reload
sudo systemctl restart wazuh-manager