CVE-2026-71540

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.6

Description The wazuh-clusterd component in framework/wazuh/core/cluster/common.py allocates a payload buffer based on the size specified in a 20-byte cluster protocol header before the peer is validated via Fernet decryption. An unauthenticated network peer can specify a payload size up to 256 MiB and cease transmission after the header, maintaining the memory allocation until the TCP connection is closed. Because the cluster listener lacks an application-level per-source connection budget, multiple concurrent sockets can excessively increase memory consumption. This may lead to the termination of the cluster process, disruption of synchronization, and interruption of distributed API forwarding.

Recommendations Update to version 4.14.7.