Vulnerability Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service (DoS) vulnerability exists in the Wazuh API authentication middleware (`middlewares.py`). The application uses an asynchronous event loop (Starlette/Asyncio) to call a synchronous function (`generate_keypair`) that performs blocking disk I/O on every request containing a Bearer token. An unauthenticated remote attacker can exploit this by flooding the API with requests containing invalid Bearer tokens. This forces the single-threaded event loop to pause for file read operations repeatedly, starving the application of CPU resources and potentially preventing it from accepting or processing legitimate connections. Version 4.14.3 fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wazuh | Wazuh | >= 4.3.0, < 4.14.3 |
Related Weaknesses (CWE)
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-33w3-p5hm-jw7gExploitVendor AdvisoryMitigation
FAQ
What is CVE-2026-25771?
CVE-2026-25771 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service (DoS) vulnerability exists in t...
How severe is CVE-2026-25771?
CVE-2026-25771 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25771?
Check the references section above for vendor advisories and patch information. Affected products include: Wazuh Wazuh.