Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service of the cluster service. This issue has been fixed in version 4.14.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33754 Remote Denial of Service via Memory Exhaustion in Wazuh Cluster Protocol Parser https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33754
Post summary
The post announces the discovery of CVE-2026-33754, a remote denial‑of‑service vulnerability in Wazuh’s cluster protocol parser, without providing PoC, exploit, patch, or technical depth.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wazuh | wazuh | - | - | - |