Vulnerability Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67
- https://github.com/wazuh/wazuh/pull/37147
- https://github.com/wazuh/wazuh/releases/tag/v4.14.7
- https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5
- https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5
FAQ
What is CVE-2026-61811?
CVE-2026-61811 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c rec...
How severe is CVE-2026-61811?
CVE-2026-61811 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61811?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.