{"id":"CVE-2026-44253","summary":"Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation","details":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.","aliases":["GHSA-h5r8-gvhv-cmp2"],"modified":"2026-09-11T03:30:57.821907838Z","published":"2026-08-19T16:06:06.158Z","database_specific":{"cwe_ids":["CWE-770","CWE-789"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44253.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44253.json"},{"type":"ADVISORY","url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-h5r8-gvhv-cmp2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44253"},{"type":"FIX","url":"https://github.com/wazuh/wazuh/commit/d29c5c89a0e16477545ca27f4e06229021e3183c"},{"type":"FIX","url":"https://github.com/wazuh/wazuh/pull/35173"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wazuh/wazuh","events":[{"introduced":"18bac2de69f5a37e5c3c4e2dfbce5a0093042ea7"},{"introduced":"cddd833300cb5af494ba7dab31192bae649eb184"},{"fixed":"460511d384aadc1d539caa6c4aa6a4234d68c9ba"},{"fixed":"b58b3b2552497639b1b2a2b23e8de87e4ce9cf02"},{"fixed":"d29c5c89a0e16477545ca27f4e06229021e3183c"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"3.9.0"},{"fixed":"4.14.5"},{"introduced":"5.0.0-beta1"},{"fixed":"5.0.0-beta2"}]}}],"versions":["v5.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44253.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}]}