Threat Intelligence Database

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

Wazuh wazuh-manager versions 4.0.0 up to but not including 4.14.6 contain a path traversal vulnerability. Authenticated cluster peers with a valid Fernet key can supply a specially crafted node name in the cluster hello payload, causing the master node to delete arbitrary directory contents within the Wazuh installation path writable by the wazuh user. This vulnerability allows unauthorized deletion of files and directories. The CVSS 4.0 score is 7.0, indicating high severity. No official patch or remediation guidance is provided in the available data.

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

Wazuh wazuh-manager versions 4.0.0 up to but not including 4.14.6 contain a path traversal vulnerability. This flaw allows unauthenticated remote attackers to cause a denial of service by enrolling an agent with a specially crafted name containing dot-sequences such as "..". The vulnerability arises from insufficient validation of agent names and unsafe path concatenation, which leads to deletion of critical directories and stops Wazuh services, requiring manual recovery.