CVE-2026-33434

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.6.0 through 4.14.4

Description A logic error in the CheckRateLimitsMiddleware.dispatch() function allows event injection into analysisd by bypassing the global rate limit. Specifically, the rate check for the '/events' endpoint unconditionally overwrites the general rate limit result. Consequently, if the global max request per minute is exceeded, requests to the '/events' endpoint still succeed as long as the events-specific counter, which is hardcoded to 30 requests per minute, has not been reached.

Recommendations Update to version 4.14.5.