CVE-2026-33754 Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)
Remote attackers can cause denial of service in Wazuh cluster services by sending crafted messages with large payload lengths, triggering uncontrolled memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33754?
CVE-2026-33754 is a medium-severity denial of service vulnerability in Wazuh Wazuh, published on 16 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service of the cluster service. This issue has been fixed in version 4.14.5.
Weakness: CWE-400
Which versions are affected by CVE-2026-33754?
It affects 1 product.
Products include Wazuh Wazuh.
How do I fix CVE-2026-33754?
No fix has been published for CVE-2026-33754 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33754 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33754 exists.
Other vulnerabilities in Wazuh Wazuh
- CVE-2025-24016 Wazuh Server Deserialization of Untrusted Data
- CVE-2024-32038 Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2021-44079 Command injection in n/a
- CVE-2024-1243 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
- CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Sources
Also known as GHSA-476v-28pp-5wg9.