{"id":"CVE-2026-112336","kind":"vulnerability","aliases":["CVE-2026-112336"],"related":[],"title":"Wazuh Manager: JSON decoder memory leak lets remote agents crash alerting","description":"Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.","summary":"Wazuh Manager versions from 3.0.0 before 4.14.9 leak memory in the generic JSON decoder when an event repeats static fields such as id. An attacker who enrolls an agent without a password can send such events and exhaust wazuh-analysisd memory until the out-of-memory killer stops alerting.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","self-hosted","siem","wazuh"],"not_affected_if":["managed-hosting","password-enrollment","patched-4.14.9"],"how_to_check":"- Check the Wazuh Manager version on the manager host with `/var/ossec/bin/wazuh-control info` and compare it to `4.14.9`.\n- Check whether agent enrollment is allowed without a password in the manager's authd configuration (unknown if the sources give the exact setting).","fix":"- Wazuh Manager: move to `4.14.9` or later.","status":"open","published_at":"2026-11-06T15:17:07+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:23+00:00","updated_at":"2026-11-06T15:44:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T15:44:23Z","model":"claude-haiku-5-5","output":{"fix":"- Wazuh Manager: move to `4.14.9` or later.","reach":"network","title":"Wazuh Manager: JSON decoder memory leak lets remote agents crash alerting","impact":"medium","summary":"Wazuh Manager versions from 3.0.0 before 4.14.9 leak memory in the generic JSON decoder when an event repeats static fields such as id. An attacker who enrolls an agent without a password can send such events and exhaust wazuh-analysisd memory until the out-of-memory killer stops alerting.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wazuh","self-hosted","siem","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Alert processing stops after the manager process is killed for memory","analyst_note":"Confirm the enrollment setting that enables the attack and check the vendor advisory for the exact affected configuration.","how_to_check":"- Check the Wazuh Manager version on the manager host with `/var/ossec/bin/wazuh-control info` and compare it to `4.14.9`.\n- Check whether agent enrollment is allowed without a password in the manager's authd configuration (unknown if the sources give the exact setting).","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","patched-4.14.9","password-enrollment"],"who_is_affected":"Teams that run a Wazuh Manager between 3.0.0 and 4.14.8 with agent enrollment open to the network are exposed. Attackers need to enroll an agent first, which passwordless enrollment allows. Managed or SaaS Wazuh deployments and managers already on 4.14.9 or later are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4344,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112336':14A,17A '-2026':13A,16A '3.0.0':29B,79C '4.14.9':31B,81C 'agent':9A,53B,110C 'alert':11A,75B,129C 'allow':93C 'analysisd':65B,100C 'attack':49B,95C,106C 'contain':82C 'crash':10A 'cve':12A,15A 'decod':4A,38B,91C 'disabl':128C 'duplic':118C 'enrol':51B,108C,113C 'event':41B,60B,116C 'exhaust':62B,97C 'field':44B,105C,119C 'generic':36B,89C 'host':22B 'id':47B,122C 'infrastructur':18B 'json':3A,37B,90C 'kill':126C 'killer':73B 'leak':6A,32B,85C 'let':7A 'linux':19B 'manag':2A,26B,77C 'memori':5A,33B,66B,72B,84C,101C 'oom':125C 'out-of-memori':69B 'password':56B 'passwordless':112C 'remot':8A,94C 'repeat':42B,103C 'self':21B 'self-host':20B 'send':58B,115C 'siem':23B 'static':43B,104C 'stop':74B 'trigger':123C 'version':27B 'via':102C 'vulner':86C 'wazuh':1A,24B,25B,64B,76C,99C 'wazuh-analysisd':63B,98C 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a Wazuh Manager between 3.0.0 and 4.14.8 with agent enrollment open to the network are exposed. Attackers need to enroll an agent first, which passwordless enrollment allows. Managed or SaaS Wazuh deployments and managers already on 4.14.9 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","linux","selfhosted","siem","wazuh"],"campaign_type":null,"search_a":"'-112336':14A,17A '-2026':13A,16A 'agent':9A 'alert':11A 'crash':10A 'cve':12A,15A 'decod':4A 'json':3A 'leak':6A 'let':7A 'manag':2A 'memori':5A 'remot':8A 'wazuh':1A","search_b":"'3.0.0':29B '4.14.9':31B 'agent':53B 'alert':75B 'analysisd':65B 'attack':49B 'decod':38B 'enrol':51B 'event':41B,60B 'exhaust':62B 'field':44B 'generic':36B 'host':22B 'id':47B 'infrastructur':18B 'json':37B 'killer':73B 'leak':32B 'linux':19B 'manag':26B 'memori':33B,66B,72B 'out-of-memori':69B 'password':56B 'repeat':42B 'self':21B 'self-host':20B 'send':58B 'siem':23B 'static':43B 'stop':74B 'version':27B 'wazuh':24B,25B,64B 'wazuh-analysisd':63B 'without':54B","search_c":"'3.0.0':79C '4.14.9':81C 'agent':110C 'alert':129C 'allow':93C 'analysisd':100C 'attack':95C,106C 'contain':82C 'decod':91C 'disabl':128C 'duplic':118C 'enrol':108C,113C 'event':116C 'exhaust':97C 'field':105C,119C 'generic':89C 'id':122C 'json':90C 'kill':126C 'leak':85C 'manag':77C 'memori':84C,101C 'oom':125C 'passwordless':112C 'remot':94C 'repeat':103C 'send':115C 'static':104C 'trigger':123C 'via':102C 'vulner':86C 'wazuh':76C,99C 'wazuh-analysisd':98C","first_public_at":"2026-11-06T10:27:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112336","severity":null,"published_at":"2026-11-06T15:17:07+00:00","modified_at":"2026-11-06T15:17:07+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87525,"url":"https://github.com/wazuh/wazuh/commit/7fdd928228fa0478814277ab3e49bda9809cd50a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87526,"url":"https://github.com/wazuh/wazuh/commit/c7df52ee8158577e7bd830e2b84d024612561f8b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87519,"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87528,"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-6w6h-fwqm-6hjj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T10:27:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87529,"url":"https://www.vulncheck.com/advisories/wazuh-manager-3.0.0-before-4.14.9-memory-leak-dos-via-json-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}