CVE-2026-74046

MEDIUM 4.9

Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

CWE	CWE-409
Vendor	wazuh
Product	wazuh-manager
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for wazuh wazuh-manager

Be the first to know when new medium vulnerabilities affecting wazuh wazuh-manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

Wazuh / wazuh-manager

4.4.0 < 4.14.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j github.com: https://github.com/wazuh/wazuh/pull/37119 vulncheck.com: https://www.vulncheck.com/advisories/wazuh-dos-via-fdecompress-files-zip-bomb

Credits

🔍 moltenbit jotacarma90