| Package | Affected versions | Patched versions |
|---|---|---|
| wazuh | ≥ 4.4.0, < 4.14.7 | 4.14.7 |
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free