CVE-2026-77021 Overview
CVE-2026-77021 is a data amplification vulnerability in the Checkmk monitoring platform. The flaw resides in the agent receiver component and affects Checkmk versions prior to 2.5.0p14, 2.4.0p37, and 2.3.0p51, along with the end-of-life 2.2.0 branch. An authenticated attacker who controls a host registered for push mode can transmit a small zlib-compressed payload that expands to an arbitrary size when decompressed. The unbounded decompression exhausts memory on the agent receiver, leading to denial of service. The weakness is categorized under [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].
Critical Impact
A compromised or malicious push-mode host can crash the Checkmk agent receiver process by sending a compact zlib bomb that decompresses to exhaust available memory.
Affected Products
- Checkmk versions prior to 2.5.0p14
- Checkmk versions prior to 2.4.0p37 and prior to 2.3.0p51
- Checkmk 2.2.0 (end-of-life)
Discovery Timeline
- 2026-09-21 - CVE-2026-77021 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-77021
Vulnerability Analysis
The Checkmk agent receiver accepts monitoring data from hosts configured for push mode. Payloads are transmitted in zlib-compressed form to reduce bandwidth. The receiver decompresses these payloads without enforcing an upper bound on the output size. An attacker who controls a registered push host can craft a small compressed blob whose decompressed size is orders of magnitude larger than the input. When the receiver processes this payload, it allocates memory proportional to the decompressed output, exhausting available RAM.
The attack falls under classic data amplification, often referred to as a zip bomb pattern applied to zlib streams. Because compression ratios of 1000:1 or higher are trivial to construct with repetitive data, a payload of a few kilobytes can decompress into gigabytes. Successful exploitation disrupts monitoring visibility across the affected Checkmk site.
Root Cause
The root cause is missing validation of decompressed payload size in the agent receiver's push-mode data ingestion path. The code streams zlib output into memory without applying a maximum length limit or incremental size check during decompression.
Attack Vector
Exploitation requires network access to the agent receiver endpoint and valid credentials for a host already registered in push mode. The attacker sends a specially crafted small zlib payload over the standard push protocol. No user interaction is required, and the receiver processes the payload as part of routine ingestion. Because push-mode hosts are authenticated, the attacker must first control such a host, which limits the vulnerability to insider or supply-chain style scenarios. See the Checkmk Update Announcement for vendor-provided technical detail.
Detection Methods for CVE-2026-77021
Indicators of Compromise
- Sudden memory exhaustion or out-of-memory (OOM) termination of the agent-receiver process on the Checkmk site.
- Push-mode ingestion requests from a single host with anomalously small request bodies followed by receiver instability.
- Gaps in monitoring data collection correlating with receiver process restarts.
Detection Strategies
- Monitor process-level memory consumption of the Checkmk agent receiver and alert on rapid growth exceeding baseline.
- Log inbound push payload sizes and compression ratios; flag entries where decompressed size exceeds a reasonable threshold.
- Correlate receiver crashes with recent push submissions from specific registered hosts to identify the source.
Monitoring Recommendations
- Enable OS-level OOM killer logging and forward events to a central log platform for correlation.
- Track systemd or supervisor restart counts for the agent-receiver service.
- Baseline normal push payload sizes per host and alert on statistical outliers.
How to Mitigate CVE-2026-77021
Immediate Actions Required
- Upgrade Checkmk to 2.5.0p14, 2.4.0p37, or 2.3.0p51 or later on the appropriate release branch.
- Migrate any remaining 2.2.0 installations off the end-of-life branch to a supported version that includes the fix.
- Audit the list of hosts registered for push mode and remove any that are not required.
Patch Information
Checkmk addressed the vulnerability by enforcing bounds on decompressed payload size in the agent receiver. Refer to the Checkmk Update Announcement (Werk 22116) for release notes and upgrade guidance.
Workarounds
- Restrict network access to the agent receiver endpoint to trusted push-mode hosts only, using firewall or reverse-proxy allowlists.
- Rotate credentials for push-mode hosts and revoke registrations for hosts suspected of compromise.
- Apply operating system memory limits (for example, systemdMemoryMax) to the receiver process to contain impact until patching is complete.
# Example: cap agent-receiver memory via systemd override
sudo systemctl edit cmk-agent-receiver@SITE.service
# Add the following lines in the editor:
# [Service]
# MemoryMax=1G
# MemoryHigh=768M
sudo systemctl daemon-reload
sudo systemctl restart cmk-agent-receiver@SITE.service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
