PT-2026-111560

CVE-2026-74030

Published

2026-10-13

Updated

2026-10-13

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.7

Description An uncontrolled YAML alias expansion issue exists in the yaml2json node component. This allows a manager-controlled policy to exhaust agent memory. An attacker with control over the manager can push a small SCA policy containing nested aliases via merged.mg to trigger an Out-Of-Memory (OOM) condition, which kills the wazuh-modulesd process on every agent within a group.

Recommendations Update to version 4.14.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Karasu-Hakira

Vikman90

Vendors

Affected products

Weakness enumeration

CWE-776: Improper Restriction of Recursive Entity References in DTDs (\'XML Entity Expansion\')