CVE-2026-61811

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61811
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61811.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61811
Aliases
  • GHSA-9wv5-7qwx-m9w5
Published
2026-09-24T17:48:01Z
Modified
2026-09-26T08:08:54Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Details

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61811.json"
}
References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type
GIT
Repo
https://github.com/wazuh/wazuh
Events
Introduced
688157e869f371271395da30cc490d45cd6d5753
Fixed
2ac70941c5980a5dd24ad8a0f2be559f840e6a67
Fixed
a42268a27c555d9348d5598fb8751eaf4c8e9024
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.8.0"
        },
        {
            "fixed":  "4.14.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

coverity-w12-4.*
coverity-w12-4.14.5
coverity-w13-4.*
coverity-w13-4.14.5
coverity-w15-4.*
coverity-w15-4.14.5
coverity-w17-4.*
coverity-w17-4.14.6
coverity-w19-4.*
coverity-w19-4.14.6
coverity-w20-4.*
coverity-w20-4.14.6
coverity-w27-4.*
coverity-w27-4.14.7
coverity-w28-4.*
coverity-w28-4.14.7
coverity-w29-4.*
coverity-w29-4.14.7
v3.*
v3.12.0
v3.13.0
v3.13.1
v3.8.0
v4.*
v4.14.1
v4.14.3-rc1
v4.14.7-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61811.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "116912415496555159598513424271469198226",
            "length":  3567
        },
        "id":  "CVE-2026-61811-16bf7125",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67",
        "target":  {
            "file":  "src/os_xml/os_xml.c",
            "function":  "_ReadElem"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "160187512691328225454466845703400895731",
            "length":  2778
        },
        "id":  "CVE-2026-61811-9a75ad6c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67",
        "target":  {
            "file":  "src/os_xml/os_xml.c",
            "function":  "_getattributes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "264737549194866555354673158568392709443",
                "11332128196762083525539591064984178513",
                "23596338596591027795951629717231008067",
                "114117366595302278752809489265249133404",
                "295366453910605982008975108152042960513",
                "310331827460953479246689595194401940968",
                "93098088474988115418231742605524696353",
                "70956211333192020353377967390593275023",
                "195898396402873583497034862490511271025",
                "4037555328922380599866187211217250033",
                "174361989045529051174133565490917621928",
                "120813115095666282350601789627788635100",
                "223292385642317673419725635800593122087",
                "244391719262598572188979899825751270761",
                "247150831097257567539715211251210381469",
                "138597837276543277561948577767049463554",
                "19549675173428302754378658740716585808",
                "264451472387941389645768932974535204757",
                "193216205548658267967333598493080580580"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-61811-ef4128fd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67",
        "target":  {
            "file":  "src/os_xml/os_xml.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:08:54Z"