PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44253 wazuh CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T16:17:10.833Z and has not been modified since then. The Wazuh cluster protocol vulnerability allows an authenticated cluster node to exhaust memory on the master node, disrupting agent connectivity and alert processing. This issue affects Wazuh versions from 3.9.0 until 4.14.5 and 5.0.0-beta2. The vulnerability is caused by the receive_str() method accepting an attacker-controlled total for InBuffer without a maximum, leading to accumulation in in_str. Additionally, the divided-message path retains flag_divided fragments in div_msg_box without limits, exacerbating the issue. Exploitation can disrupt agent connectivity and alert processing across the monitored environment.

Vendor
wazuh
Product
Unknown
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-25
Advisory published
2026-08-19
Advisory updated
2026-08-25

Who should care

Wazuh cluster administrators, security teams monitoring for potential disruptions in agent connectivity and alert processing, and organizations relying on Wazuh for threat prevention and detection.

Technical summary

The Wazuh cluster protocol vulnerability allows an authenticated cluster node to exhaust memory on the master node. This is due to the receive_str() method accepting an attacker-controlled total for InBuffer without a maximum, leading to accumulation in in_str. Additionally, the divided-message path retains flag_divided fragments in div_msg_box without limits, exacerbating the issue. The vulnerability affects Wazuh versions from 3.9.0 until 4.14.5 and 5.0.0-beta2, and can be mitigated by applying vendor patches in versions 4.14.5 and 5.0.0-beta2 or later. The vulnerability can disrupt agent connectivity and alert processing across the monitored environment, and Wazuh cluster administrators should assess their deployments for exposure and implement monitoring for abnormal memory usage in Wazuh master nodes.

Defensive priority

Authenticated cluster nodes can be leveraged to exhaust memory on the master node via the Wazuh cluster protocol, disrupting agent connectivity and alert processing.

Recommended defensive actions

  • Inventory and assess Wazuh cluster deployments for exposure.
  • Restrict cluster node authentication to trusted sources.
  • Implement monitoring for abnormal memory usage in Wazuh master nodes.
  • Apply vendor patches in versions 4.14.5 and 5.0.0-beta2 or later.
  • Review and limit resource allocation for InBuffer and div_msg_box.

Evidence notes

The Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, and repeated requests accumulate in in_str. The divided-message path retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44253 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44253

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44253 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44253

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.