---
id: "CVE-2026-112336"
page: "https://infrastack.ai/live/CVE-2026-112336"
kind: "vulnerability"
aliases: ["CVE-2026-112336"]
title: "Wazuh Manager: JSON decoder memory leak lets remote agents crash alerting"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "self-hosted", "siem", "wazuh"]
not_affected_if: ["managed-hosting", "password-enrollment", "patched-4.14.9"]
published_at: "2026-11-06T15:17:07+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:44:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112336", "first_seen_at": "2026-11-06T15:42:43+00:00"}]
exploit_sources: []
---

# Wazuh Manager: JSON decoder memory leak lets remote agents crash alerting

Link for people: https://infrastack.ai/live/CVE-2026-112336 (this .md is for agents)

Wazuh Manager versions from 3.0.0 before 4.14.9 leak memory in the generic JSON decoder when an event repeats static fields such as id. An attacker who enrolls an agent without a password can send such events and exhaust wazuh-analysisd memory until the out-of-memory killer stops alerting.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wazuh Manager version on the manager host with `/var/ossec/bin/wazuh-control info` and compare it to `4.14.9`.
- Check whether agent enrollment is allowed without a password in the manager's authd configuration (unknown if the sources give the exact setting).

## Fix

- Wazuh Manager: move to `4.14.9` or later.

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112336

## Documents

- [advisory] Vendor advisory: github.com https://github.com/wazuh/wazuh/security/advisories/GHSA-6w6h-fwqm-6hjj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wazuh-manager-3.0.0-before-4.14.9-memory-leak-dos-via-json-decoder
- [fix] Patch: github.com https://github.com/wazuh/wazuh/commit/7fdd928228fa0478814277ab3e49bda9809cd50a
- [fix] Patch: github.com https://github.com/wazuh/wazuh/commit/c7df52ee8158577e7bd830e2b84d024612561f8b
- [fix] Release notes: github.com https://github.com/wazuh/wazuh/releases/tag/v4.14.9

## From the sources

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_