CVE-2026-44253

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.4 Wazuh versions 5.0.0-beta1 and earlier

Description The cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to cause memory exhaustion on the master node. The receive str() method accepts an attacker-controlled total for InBuffer without a maximum limit, enabling a new str command to request multi-gigabyte bytearrays that accumulate in in str. Additionally, the divided-message path retains flag divided fragments under unique counters in div msg box without limits on count, aggregate size, or expiration. This can disrupt agent connectivity and alert processing across the monitored environment.

Recommendations Update to version 4.14.5. Update to version 5.0.0-beta2.