CVE-2026-74046

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.6

Description A denial of service issue exists in the fdecompress files() function within cluster.py. Authenticated cluster peers possessing a valid cluster Fernet key can trigger memory exhaustion and service disruption on the master node by uploading a malicious synchronization archive. This is achieved using a zip bomb, which is a small, highly compressed archive that expands to a massive size when decompressed, forcing wazuh-clusterd to load the full payload into memory due to a lack of decompressed size limits.

Recommendations Update to version 4.14.7 or later.