Read the docs
TI-2026-85941 Aliases CVE-2026-112336

Wazuh Manager JSON Decoder Memory Leak Enables Denial of Service

Priority LOW 32CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-401.

Summary

Wazuh Manager from 3.0.0 before 4.14.9 has a memory leak in its generic JSON decoder (CWE-401). Remote attackers who enroll an agent through passwordless enrollment can send events with repeated static fields such as id, exhausting wazuh-analysisd memory until the OOM killer terminates it and alerting stops. The CVSS 4.0 base score is 7.1 (HIGH), with availability impact only.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

Why it matters now

EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed wazuh (wazuh): 4.14.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wazuhwazuh3.0.0 to before 4.14.94.14.9Patch availableCNA
  • wazuh VendorWazuh Affected 3.0.0 to before 4.14.9 Fixed in 4.14.9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*——Wazuh
  • cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* Versions — — ·Wazuh

Remediation

Upgrade Wazuh Manager to version 4.14.9 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wazuh (wazuh) Fixed in 4.14.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wazuh 4.14.9

    7 records Highest priority Priority HIGH 1 HIGH, 6 LOW

    Other records, highest priority first

    • TI-2026-85943 Server-side request forgery in Wazuh GitHub module leaks API tokenPriority HIGH 69
    • TI-2026-85944 Missing TLS hostname verification in Wazuh fluent-forward modulePriority LOW 35
    • TI-2026-85946 SQL injection in Wazuh WazuhDBBackend exposes agent internal keysPriority LOW 31
    Show all 7 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-112336
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

Other 1

  • TI-2025-17783 Remote code execution in Wazuh server KEVCVSS 3.1CRITICAL 9.9
  • TI-2026-47604 Wazuh GitHub Actions Shell Injection via Fork Pull Request CVSS 4.0CRITICAL 9.3
  • TI-2026-71739 Missing origin check in Wazuh manager allows arbitrary file read CVSS 4.0HIGH 8.7
  • TI-2026-71743 Arbitrary file overwrite in Wazuh manager enables root code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-23722 Path traversal in wazuh CVSS 3.1CRITICAL 9.9
  • TI-2024-01157 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft CVSS 4.0CRITICAL 9.5
See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences