CVE-2026-112336

EUVD-2026-118279
Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wazuhwazuh
3.0.0 ≤
𝑥
< 4.14.9
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/wazuh/wazuh/commit/7fdd928228fa0478814277ab3e49bda9809cd50a
https://github.com/wazuh/wazuh/commit/c7df52ee8158577e7bd830e2b84d024612561f8b
https://github.com/wazuh/wazuh/releases/tag/v4.14.9
https://github.com/wazuh/wazuh/security/advisories/GHSA-6w6h-fwqm-6hjj
https://www.vulncheck.com/advisories/wazuh-manager-3.0.0-before-4.14.9-memory-leak-dos-via-json-decoder