4 matches found
EUVD-2026-61077
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...
CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...
CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...
CVE-2026-74046
Wazuh 4.4.0 through 4.14.6 is affected by a denial-of-service flaw in the fdecompress_files() function of cluster.py. The function decompresses synchronization archives without enforcing any decompressed size limit, so an attacker holding a valid cluster Fernet key can upload a small zip-bomb arc...