CVE-2026-74046: Wazuh Denial of Service Vulnerability

CVE-2026-74046 Overview

CVE-2026-74046 is a denial of service vulnerability in Wazuh versions 4.4.0 through 4.14.6. The flaw resides in the fdecompress_files() function within cluster.py and stems from missing decompressed size limits on synchronization archives. Authenticated cluster peers holding a valid Fernet key can upload a small, highly compressed zip bomb that forces wazuh-clusterd on the master node to decompress the payload into memory. This exhausts memory and disrupts cluster synchronization services. The weakness is tracked as [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].

Critical Impact
A malicious cluster peer can crash the Wazuh master node's clusterd process by uploading a zip bomb, disrupting agent management and monitoring services.

Affected Products

Wazuh 4.4.0 through 4.14.6
wazuh-clusterd daemon on master nodes
Fixed in Wazuh 4.14.7

Discovery Timeline

2026-08-18 - CVE-2026-74046 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-74046

Vulnerability Analysis

Wazuh clusters synchronize state between worker and master nodes using zip archives encrypted with a shared Fernet key. The fdecompress_files() function in cluster.py extracts these archives on the master node without enforcing a maximum decompressed size. A peer with valid cluster credentials can supply a highly compressed archive whose decompressed content is orders of magnitude larger than the payload transmitted over the network. When wazuh-clusterd processes the archive, it allocates memory proportional to the decompressed size rather than the compressed transport size, exhausting available RAM on the master.

Root Cause

The root cause is the absence of a decompressed size ceiling and streaming validation in fdecompress_files(). Decompression proceeds until the archive is fully expanded, without checks against an upper bound or comparison to the compressed size ratio. This pattern matches [CWE-409], where an application processes compressed input without accounting for amplification.

Attack Vector

Exploitation requires network access to the cluster synchronization port and possession of a valid cluster Fernet key. An attacker who has compromised a worker node, or who otherwise controls a legitimate cluster peer, crafts a zip bomb archive and submits it during a routine synchronization cycle. The master node's wazuh-clusterd process consumes memory until the kernel out-of-memory killer terminates it or the host becomes unresponsive. No user interaction is required, and the attack completes as soon as the archive is decompressed.

Because verified proof-of-concept code is not published for this CVE, refer to the Wazuh Security Advisory GHSA-mr7j-w2m4-vw5j and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-74046

Indicators of Compromise

Sudden memory exhaustion or OOM-kill events targeting the wazuh-clusterd process on the master node.
Cluster synchronization archives with unusually small on-wire size but expected decompression footprints in the hundreds of megabytes or gigabytes.
Repeated crashes or restarts of wazuh-clusterd shortly after a peer synchronization event.

Detection Strategies

Monitor process memory growth for wazuh-clusterd and alert on rapid allocation spikes exceeding baseline synchronization behavior.
Correlate cluster peer connections with subsequent daemon crashes using Wazuh internal logs at /var/ossec/logs/cluster.log.
Inspect incoming synchronization archives for anomalous compression ratios above a defined threshold, for example greater than 100:1.

Monitoring Recommendations

Enable resource monitoring on the master node with alerts on memory pressure and OOM events tied to Wazuh processes.
Audit access to cluster Fernet keys stored in ossec.conf and rotate keys if worker node compromise is suspected.
Log and review all cluster peer connection sources to detect unauthorized or unexpected participants.

How to Mitigate CVE-2026-74046

Immediate Actions Required

Upgrade Wazuh master and worker nodes to version 4.14.7 or later.
Restrict network access to the cluster synchronization port so only trusted worker nodes can connect.
Rotate the cluster Fernet key if any worker node is suspected of compromise.
Review cluster logs for prior signs of memory exhaustion or unexplained wazuh-clusterd restarts.

Patch Information

Wazuh addressed the vulnerability in version 4.14.7 by enforcing decompressed size limits within fdecompress_files(). The fix is documented in Wazuh Pull Request #37119 and the corresponding GitHub Security Advisory. Administrators should apply the update on all cluster nodes and restart the wazuh-clusterd service.

Workarounds

Isolate the cluster synchronization network using firewall rules that permit only known worker node IP addresses to reach the master.
Enforce operating system memory limits on the wazuh-clusterd process using systemdMemoryMax or cgroup constraints to contain damage from decompression bombs.
Monitor cluster peer inventory and remove or disable any worker node that is not required for production operations.

bash

# Example systemd override to cap wazuh-clusterd memory usage
# /etc/systemd/system/wazuh-manager.service.d/override.conf
[Service]
MemoryMax=2G
MemoryHigh=1500M