CVE-2026-71540

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71540
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71540.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71540
Aliases
  • GHSA-78wx-4r6w-w73f
Published
2026-09-24T17:49:29Z
Modified
2026-09-26T03:47:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
Details

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget in affected versions, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71540.json"
}
References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type
GIT
Repo
https://github.com/wazuh/wazuh
Events
Introduced
18bac2de69f5a37e5c3c4e2dfbce5a0093042ea7
Fixed
9a996bc23d28725f6c1f8f7808355d90e20d3382
Fixed
a42268a27c555d9348d5598fb8751eaf4c8e9024
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.9.0"
        },
        {
            "fixed":  "4.14.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71540.json"