{"apiVersion":"1.0","identifier":"CVE-2026-44253","description":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receive_str() method accepts an attacker-controlled total for InBuffer without a maximum, so a new_str command can request a multi-gigabyte bytearray and repeated requests accumulate in in_str. The divided-message path also retains flag_divided fragments under unique counters in div_msg_box without a count, aggregate-size, or expiration limit. Exploitation can disrupt agent connectivity and alert processing across the monitored environment. This issue is fixed in versions 4.14.5 and 5.0.0-beta2.","publishedAt":"2026-08-19T16:17:10","lastModifiedAt":"2026-08-25T03:16:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44253","cvssScore":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00417,"riskScore":0.51,"affectedProduct":"Wazuh","affectedVersions":">=3.9.0,<4.14.5,>=5.0.0-beta2,<5.0.0-beta2","vulnerabilityType":"Critical software","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-44253","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-44253","en":"https://www.redsauce.net/en/cves/CVE-2026-44253","fr":"https://www.redsauce.net/fr/cves/CVE-2026-44253","pt":"https://www.redsauce.net/pt/cves/CVE-2026-44253","de":"https://www.redsauce.net/de/cves/CVE-2026-44253","sk":"https://www.redsauce.net/sk/cves/CVE-2026-44253","el":"https://www.redsauce.net/el/cves/CVE-2026-44253"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-44253"}}