CVE-2026-33754: Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-17 · updated 2026-07-20
Weakness: CWE-400

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service of the cluster service. This issue has been fixed in version 4.14.5.

Affected products

wazuh: from 3.9.0 before 4.14.5 — fixed in 4.14.5

How to fix

Upgrade to a fixed version: wazuh 4.14.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33754 or the next vulnerability affects your stack