{"id":"CVE-2026-61811","summary":"Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion","details":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.","aliases":["GHSA-9wv5-7qwx-m9w5"],"modified":"2026-09-26T08:08:54.304816Z","published":"2026-09-24T17:48:01.629Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61811.json"},"references":[{"type":"WEB","url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61811.json"},{"type":"ADVISORY","url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61811"},{"type":"FIX","url":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67"},{"type":"FIX","url":"https://github.com/wazuh/wazuh/pull/37147"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wazuh/wazuh","events":[{"introduced":"688157e869f371271395da30cc490d45cd6d5753"},{"fixed":"2ac70941c5980a5dd24ad8a0f2be559f840e6a67"},{"fixed":"a42268a27c555d9348d5598fb8751eaf4c8e9024"}],"database_specific":{"extracted_events":[{"introduced":"3.8.0"},{"fixed":"4.14.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["coverity-w29-4.14.7","v4.14.7-rc1","coverity-w28-4.14.7","coverity-w27-4.14.7","coverity-w20-4.14.6","coverity-w19-4.14.6","coverity-w17-4.14.6","coverity-w15-4.14.5","coverity-w13-4.14.5","coverity-w12-4.14.5","v4.14.1","v4.14.3-rc1","v3.13.1","v3.13.0","v3.12.0","v3.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61811.json","vanir_signatures_modified":"2026-09-26T08:08:54Z","vanir_signatures":[{"target":{"file":"src/os_xml/os_xml.c","function":"_ReadElem"},"deprecated":false,"digest":{"function_hash":"116912415496555159598513424271469198226","length":3567},"id":"CVE-2026-61811-16bf7125","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67"},{"deprecated":false,"digest":{"function_hash":"160187512691328225454466845703400895731","length":2778},"id":"CVE-2026-61811-9a75ad6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67","target":{"file":"src/os_xml/os_xml.c","function":"_getattributes"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67","target":{"file":"src/os_xml/os_xml.c"},"deprecated":false,"digest":{"line_hashes":["264737549194866555354673158568392709443","11332128196762083525539591064984178513","23596338596591027795951629717231008067","114117366595302278752809489265249133404","295366453910605982008975108152042960513","310331827460953479246689595194401940968","93098088474988115418231742605524696353","70956211333192020353377967390593275023","195898396402873583497034862490511271025","4037555328922380599866187211217250033","174361989045529051174133565490917621928","120813115095666282350601789627788635100","223292385642317673419725635800593122087","244391719262598572188979899825751270761","247150831097257567539715211251210381469","138597837276543277561948577767049463554","19549675173428302754378658740716585808","264451472387941389645768932974535204757","193216205548658267967333598493080580580"],"threshold":0.9},"id":"CVE-2026-61811-ef4128fd"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}