CVE-2026-74046

MediumCVSS 4.9/10Last modified Oct 22, 2026

Description

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Vendor	Product	Versions
Wazuh	wazuh-manager	>= 4.4.0, < 4.14.7

References

https://github.com/wazuh/wazuh/pull/37119Issue Tracking, Patch
https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5jExploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/wazuh-dos-via-fdecompress-files-zip-bombThird Party Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5jExploit, Mitigation, Vendor Advisory

Timeline

Published: Aug 18, 2026
Last modified: Oct 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-740476.5Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve CVE-2026-740486.5Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIP CVE-2026-740496.1Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.CVE-2026-74055.5A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the im CVE-2026-74067.8A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A ma CVE-2026-74074.7A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function sa CVE-2026-74084.7A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /a CVE-2026-74094.7A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_user of the file /admin/ajax.php?action CVE-2026-74106.3A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/aj CVE-2026-741110.0In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unau CVE-2026-74128.6In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UR CVE-2026-74139.8A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to p