CVE-2026-74039

Katalog CVE

CVSS 6.5 · Medium EPSS 0,56%

Kerentanan Allocation of Resources Without Limits or Throttling pada wazuh. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wazuh/wazuh/security/advisories/GHSA-5vh8-34r8-q74q exploit · mitigasi · advisory vendor
• https://github.com/wazuh/wazuh/pull/37034 issue tracking · patch
• https://www.vulncheck.com/advisories/wazuh-api-dos-via-deeply-nested-json-auth-context advisory pihak ketiga