This vulnerability (CWE-409) in Checkmk allows an attacker with control over a host registered for push mode to exploit data amplification by sending a small compressed payload that decompresses to an arbitrarily large size. This leads to memory exhaustion in the agent receiver component. The affected versions are 2.2.0 (EOL), and all versions from 2.3.0 up to but not including 2.3.0p51, 2.4.0 up to but not including 2.4.0p37, and 2.5.0 up to but not including 2.5.0p14.

An attacker with limited privileges (control over a registered host) can cause a denial of service by exhausting memory resources on the agent receiver, potentially disrupting monitoring or management functions. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited privileges required.

Patch versions 2.5.0p14, 2.4.0p37, and 2.3.0p51 address this vulnerability. Users should upgrade to these fixed versions or later. Since the vulnerability affects on-premises software, remediation requires applying these official fixes. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated in other ways.