CVE-2026-74030

4.9Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.9Medium

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on availability
Weakness: CWE-776

Impact

An attacker with control of the Wazuh manager can crash wazuh-modulesd across all connected agents via an out-of-memory denial of service. They require administrative access to the manager to push a malicious SCA policy file.

Root cause

The yaml2json_node component expands nested YAML aliases without depth limits, causing exponential memory consumption during parsing.

Affected systems

Wazuh 3.9.0 before 4.14.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade Wazuh agents and manager to version 4.14.8 or later. If upgrading immediately is not possible, audit and restrict access to manager-side shared configuration groups and custom SCA policies distributed via merged.mg.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade wazuh-agent

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74030