Moltenbit

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

The QUIC stack fails to enforce connection-level flow control for streams, although it correctly enforces stream-level limits. A remote peer can bypass the intended connection flow control window (default 768 KiB) by opening multiple streams that each remain within their individual stream-level limits. This allows a remote peer to force the local stack to allocate approximately 100MB of heap memory per connection, as the allocation is calculated as 2 x `MAX STREAMS` x (stream flow control limit).

An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate the node name provided in the cluster hello payload. An attacker possessing a valid cluster Fernet key can provide a traversal-shaped node name and then disconnect, which triggers the master's peer cleanup routine to remove the specified directories. Path traversal is a technique used to access files or directories outside the intended folder by using special characters like dot-dot-slash.

A denial of service issue exists in the `fdecompress files()` function within `cluster.py`. Authenticated cluster peers possessing a valid cluster Fernet key can trigger memory exhaustion and service disruption on the master node by uploading a malicious synchronization archive. This is achieved using a zip bomb, which is a small, highly compressed archive that expands to a massive size when decompressed, forcing `wazuh-clusterd` to load the full payload into memory due to a lack of decompressed size limits.

Server-Side Request Forgery (SSRF) occurs during the repository migration process via HTTP Redirect. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.