CVE-2026-74046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74046", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-14T14:06:40.513Z", "datePublished": "2026-08-18T17:27:24.053Z", "dateUpdated": "2026-10-01T15:20:46.250Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:46.250Z"}, "datePublic": "2026-08-18T00:00:00.000Z", "title": "Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb", "descriptions": [{"lang": "en", "value": "Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-409", "description": "Improper Handling of Highly Compressed Data (Data Amplification)", "type": "CWE"}]}], "affected": [{"vendor": "Wazuh", "product": "wazuh-manager", "packageURL": "pkg:github/wazuh/wazuh", "repo": "https://github.com/wazuh/wazuh", "defaultStatus": "unaffected", "versions": [{"version": "4.4.0", "status": "affected", "versionType": "semver", "lessThan": "4.14.7"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "4.14.7"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 4.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j", "name": "GitHub Security Advisory (GHSA-mr7j-w2m4-vw5j)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/wazuh/wazuh/pull/37119", "name": "Pull Request", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/wazuh-dos-via-fdecompress-files-zip-bomb", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "moltenbit", "type": "finder"}, {"lang": "en", "value": "jotacarma90", "type": "analyst"}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade the affected package to 4.14.7 or later."}], "timeline": [{"time": "2026-05-19T00:00:00.000Z", "lang": "en", "value": "Reported to the Wazuh security team"}]}, "adp": [{"references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T19:26:44.382567Z", "id": "CVE-2026-74046", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T19:27:06.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74046", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T19:26:44.382567Z"}}}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T19:27:03.113Z"}}], "cna": {"title": "Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "moltenbit"}, {"lang": "en", "type": "analyst", "value": "jotacarma90"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/wazuh/wazuh", "vendor": "Wazuh", "product": "wazuh-manager", "versions": [{"status": "affected", "version": "4.4.0", "lessThan": "4.14.7", "versionType": "semver"}], "packageURL": "pkg:github/wazuh/wazuh", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-19T00:00:00.000Z", "value": "Reported to the Wazuh security team"}], "solutions": [{"lang": "en", "value": "Upgrade the affected package to 4.14.7 or later."}], "datePublic": "2026-08-18T00:00:00.000Z", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j", "name": "GitHub Security Advisory (GHSA-mr7j-w2m4-vw5j)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/wazuh/wazuh/pull/37119", "name": "Pull Request", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/wazuh-dos-via-fdecompress-files-zip-bomb", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.7", "versionStartIncluding": "4.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:46.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74046", "state": "PUBLISHED", "dateUpdated": "2026-10-01T15:20:46.250Z", "dateReserved": "2026-08-14T14:06:40.513Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-18T17:27:24.053Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/wazuh/wazuh", "product": "wazuh-manager", "repo": "https://github.com/wazuh/wazuh", "vendor": "Wazuh", "versions": [{"lessThan": "4.14.7", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "matchCriteriaId": "429DB5E1-4B6C-47A8-83FE-3494F6AFC11E", "versionEndExcluding": "4.14.7", "versionStartIncluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption."}, {"lang": "es", "value": "Wazuh 4.4.0 antes de 4.14.7 contiene una vulnerabilidad de denegaci\u00f3n de servicio en la funci\u00f3n fdecompress_files() dentro de cluster.py que permite a los pares de cl\u00faster autenticados agotar la memoria al proporcionar un archivo de sincronizaci\u00f3n malicioso sin l\u00edmites de tama\u00f1o descomprimido. Los atacantes que poseen una clave Fernet de cl\u00faster v\u00e1lida pueden cargar un archivo zip bomb peque\u00f1o y altamente comprimido que fuerza a wazuh-clusterd en el nodo maestro a descomprimir la carga \u00fatil completa en la memoria, causando agotamiento de memoria e interrupci\u00f3n del servicio."}], "id": "CVE-2026-74046", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74046", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T19:26:44.382567Z", "version": "2.0.3"}}]}, "published": "2026-08-18T18:19:34.053", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/wazuh/wazuh/pull/37119"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/wazuh-dos-via-fdecompress-files-zip-bomb"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mr7j-w2m4-vw5j"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.14.7)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "wazuh-manager", "source": "cna", "vendor": "Wazuh"}, "product": "wazuh-manager", "vendor": "wazuh"}], "created": "2026-08-18T18:30:16.285677+00:00", "updated": "2026-08-21T21:00:03.303025+00:00", "vendors": ["wazuh", "wazuh$PRODUCT$wazuh-manager"]}