HIGH 7.1 NVD
CVE-2026-112336
Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd
Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.
References
- https://github.com/wazuh/wazuh/commit/7fdd928228fa0478814277ab3e49bda9809cd50a
- https://github.com/wazuh/wazuh/commit/c7df52ee8158577e7bd830e2b84d024612561f8b
- https://github.com/wazuh/wazuh/releases/tag/v4.14.9
- https://github.com/wazuh/wazuh/security/advisories/GHSA-6w6h-fwqm-6hjj
- https://www.vulncheck.com/advisories/wazuh-manager-3.0.0-before-4.14.9-memory-leak-dos-via
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.