CVE-2026-112336Medium· 6.5▾ SunlitWazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through pass…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.
wazuh >= 3.0.0 < 4.14.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112334Medium· 4.9Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
CVE-2026-112335Medium· 5.5Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
CVE-2026-112337Low· 3.7Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination
CVE-2026-112338Medium· 5.9Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
CVE-2026-112339Medium· 5.9Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
CVE-2026-112341Medium· 6.5Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params