CVE-2026-74030: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in Wazuh wazuh-agent

Wazuh agent versions >=3.9.0 and <4.14.8 contain an uncontrolled YAML alias expansion vulnerability in the yaml2json_node function. This flaw allows a manager with control over policies to craft a small Security Configuration Assessment (SCA) policy containing nested YAML aliases. When this policy is pushed via merged.mg, it triggers recursive alias expansion that exhausts the agent's memory, causing wazuh-modulesd to be OOM-killed on every agent in the group.

An attacker with manager privileges can cause denial of service on Wazuh agents by exhausting memory resources, resulting in the termination of the wazuh-modulesd process. This disrupts agent functionality and monitoring capabilities. There is no indication of privilege escalation or data compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict manager privileges to trusted users only to prevent malicious policy pushes. Monitor for unusual memory usage on agents as a potential indicator of exploitation.