CVE-2026-74030: Wazuh YAML Alias Expansion DoS Vulnerability

CVE-2026-74030 Overview

CVE-2026-74030 is a memory exhaustion vulnerability in Wazuh, an open-source security monitoring platform. The flaw resides in the yaml2json_node function and stems from uncontrolled YAML alias expansion [CWE-776] when parsing Security Configuration Assessment (SCA) policies. Wazuh versions from 3.9.0 before 4.14.8 are affected. An attacker who controls the Wazuh manager can push a small SCA policy containing nested YAML aliases through merged.mg distribution. When agents parse the policy, alias expansion consumes exponential memory and triggers the Linux Out-Of-Memory (OOM) killer against wazuh-modulesd on every agent in the targeted group.

Critical Impact
A manager-controlled malicious SCA policy can OOM-kill wazuh-modulesd across every agent in a Wazuh group, disabling security monitoring fleet-wide.

Affected Products

Wazuh server and agent components from version 3.9.0 up to (but not including) 4.14.8
Deployments using Security Configuration Assessment (SCA) policy distribution via merged.mg
Any Wazuh managed group whose manager has been compromised or operated by an untrusted administrator

Discovery Timeline

2026-10-13 - CVE-2026-74030 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-74030

Vulnerability Analysis

The vulnerability sits inside the yaml2json_node routine used by wazuh-modulesd to parse SCA policy files. YAML supports anchors and aliases, allowing a node to reference a previously defined node. Nested aliases that reference other alias-containing nodes expand multiplicatively during serialization. The Wazuh parser performs this expansion without limits on depth, breadth, or resulting document size. A compact source document of a few kilobytes can expand into gigabytes of in-memory JSON. Because wazuh-modulesd runs as a persistent agent process, memory exhaustion forces the Linux kernel OOM killer to terminate it, stopping SCA, FIM, and related modules on the agent.

Root Cause

The root cause is uncontrolled recursion during YAML alias resolution inside yaml2json_node. The function materializes alias references into fully expanded JSON structures without enforcing bounds on expansion count or final document size, a classic instance of the "Billion Laughs" class of attacks tracked under [CWE-776].

Attack Vector

Exploitation requires manager-level control, so the privilege barrier is high. An attacker who has already compromised the Wazuh manager, or an insider with manager privileges, authors a crafted SCA policy containing nested aliases. The policy is distributed to agents through the standard merged.mg group configuration channel. On each receiving agent, wazuh-modulesd parses the policy, exhausts available RAM, and is killed by the kernel. The attack scales to every agent in the targeted group with a single policy push.

No verified public exploit code is available at this time. See the GitHub Security Advisory GHSA-x8v7-g49q-ff7j and the VulnCheck Advisory for Wazuh Memory Exhaustion for additional technical context.

Detection Methods for CVE-2026-74030

Indicators of Compromise

Kernel oom-killer log entries in /var/log/messages or journalctl -k naming wazuh-modulesd as the terminated process.
Unexpected restarts or crash loops of wazuh-modulesd across multiple agents in the same group within a short time window.
Recent modifications to etc/shared/<group>/merged.mg or SCA policy YAML files on the manager that contain large numbers of YAML anchors (&) and aliases (*).
Sudden spikes in resident memory usage of wazuh-modulesd immediately preceding process termination.

Detection Strategies

Hunt for YAML files under Wazuh configuration paths containing dense alias chains or nested anchor references.
Correlate OOM-killer kernel events with Wazuh agent disconnect notifications on the manager.
Monitor file integrity on the manager's etc/shared/ directory to flag unauthorized SCA policy additions or edits.

Monitoring Recommendations

Alert on simultaneous wazuh-modulesd crashes across multiple agents belonging to the same group.
Track agent connectivity gaps that follow a group configuration push from the manager.
Baseline memory consumption of wazuh-modulesd and alert on anomalous growth rates during SCA scans.

How to Mitigate CVE-2026-74030

Immediate Actions Required

Upgrade all Wazuh manager and agent components to version 4.14.8 or later as published in the Wazuh Release v4.14.8.
Audit existing SCA policies and merged.mg files for unexpected YAML anchors and aliases prior to upgrade.
Review manager administrative access and rotate credentials for any accounts that may be shared or overly privileged.
Enable file integrity monitoring on manager-side SCA policy directories to detect future tampering.

Patch Information

The fix is delivered in Wazuh 4.14.8. The release introduces bounds on YAML alias expansion in yaml2json_node to prevent uncontrolled memory growth. Operators should upgrade managers before upgrading agents to maintain protocol compatibility. Refer to the GitHub Security Advisory GHSA-x8v7-g49q-ff7j for the full fix description.

Workarounds

Restrict manager administrative access to a minimal set of trusted operators until the upgrade is complete.
Review and sanitize any SCA policies authored by third parties before distributing them to agent groups.
Apply systemd memory limits to wazuh-modulesd using MemoryMax= so that OOM termination is bounded and recovery is predictable.
Segment agents into smaller groups to limit the blast radius of a malicious policy push.

bash

# Example: cap wazuh-modulesd memory via systemd drop-in to contain OOM impact
sudo systemctl edit wazuh-agent
# Add:
# [Service]
# MemoryMax=512M
# MemoryHigh=384M
sudo systemctl daemon-reload
sudo systemctl restart wazuh-agent