CVE-2026-25771Disclosure(wazuh / wazuh)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service (DoS) vulnerability exists in the Wazuh API authentication middleware (`middlewares.py`). The application uses an asynchronous event loop (Starlette/Asyncio) to call a synchronous function (`generate_keypair`) that performs blocking disk I/O on every request containing a Bearer token. An unauthenticated remote attacker can exploit this by flooding the API with requests containing invalid Bearer tokens. This forces the single-threaded event loop to pause for file read operations repeatedly, starving the application of CPU resources and potentially preventing it from accepting or processing legitimate connections. Version 4.14.3 fixes the issue.

wazuh CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/wazuh/wazuh/security/advisories/GHSA-33w3-p5hm-jw7g

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wazuh

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

wazuh

Products

wazuh

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew205d
Disclosure
CVE-2026-25771 Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Servi… https://www.cve.org/CVERecord?id=CVE-2026-25771
Post summary
CVE-2026-25771 is a denial‑of‑service vulnerability affecting Wazuh versions 4.3.0 through 4.14.3; the notice merely cites the CVE and links to the record, without providing PoC, exploit code, or patch information.
01010129
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds205d
Disclosure
CVE-2026-25771 Unauthenticated Denial of Service Vulnerability in Wazuh API Authentication Middleware https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25771
Post summary
The post announces CVE-2026-25771 as an unauthenticated Denial of Service vulnerability in Wazuh’s API authentication middleware, providing a brief technical description and linking to a vulnerability database page.
0000066
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wazuh	wazuh	-	-	-

Explore more

Back to dashboard wazuh CVEs wazuh vulnerabilities