CVE-2026-61811
Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.
| CWE | CWE-674 |
| Vendor | wazuh |
| Product | wazuh |
| Published | Sep 24, 2026 |
| Last Updated | Sep 24, 2026 |
Get instant alerts for wazuh wazuh
Be the first to know when new medium vulnerabilities affecting wazuh wazuh are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H