CVE-2026-112336 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Wazuh Manager versions from 3.0.0 before 4.14.9 leak memory in the generic JSON decoder when an event repeats static fields such as id. An attacker who enrolls an agent without a password can send such events and exhaust wazuh-analysisd memory until the out-of-memory killer stops alerting.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a Wazuh Manager between 3.0.0 and 4.14.8 with agent enrollment open to the network are exposed. Attackers need to enroll an agent first, which passwordless enrollment allows. Managed or SaaS Wazuh deployments and managers already on 4.14.9 or later are not affected.
Not affected if managed-hosting, password-enrollment, patched-4.14.9
Who cares linux, self-hosted, siem, wazuh
/var/ossec/bin/wazuh-control info and compare it to 4.14.9.4.14.9 or later.Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.