CVE-2026-61811— Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Quick assessment
Affected
wazuh wazuh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wazuh 是一个开源的安全平台，为端点和云工作负载提供统一的 XDR 和 SIEM 保护功能。从版本 3.8.0 到 4.14.7， 中的 函数在处理 XML 属性时没有设置递归深度限制，且每个栈帧中都会分配两个较大的局部缓冲区。已注册的 Wazuh 代理可以提交一个 Windows EventChannel 事件，其中包含一个拥有足够多属性的元素，从而耗尽 工作线程的栈空间，引发段错误（segmentation fault），并中断日志的接收过程。 中设置的元素深度限制无法约束单个元素上的属性数量，因此无法防止
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61811
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-61811
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61811
请登录查看更多情报信息。
Other References for CVE-2026-61811 (4)
IV. Related Vulnerabilities
Same product: wazuh
-
CVE-2026-71540
Wazuh Manager cluster header parsing allows pre-authenticati -
CVE-2026-61802
Wazuh discloses cleartext cluster key to low-privilege API u -
CVE-2026-61800
Wazuh cluster worker file sync allows arbitrary file write u -
CVE-2026-61783
Wazuh: RBAC permission-effect check in mask_sensitive_config -
CVE-2026-54084
Wazuh agent enrollment NULL pointer dereference via malforme
Same vendor: wazuh
-
CVE-2026-71540
Wazuh Manager cluster header parsing allows pre-authenticati -
CVE-2026-61802
Wazuh discloses cleartext cluster key to low-privilege API u -
CVE-2026-61800
Wazuh cluster worker file sync allows arbitrary file write u -
CVE-2026-61783
Wazuh: RBAC permission-effect check in mask_sensitive_config -
CVE-2026-54084
Wazuh agent enrollment NULL pointer dereference via malforme
Same weakness: CWE-674
-
CVE-2026-100702
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipie -
CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node -
CVE-2026-92564
Apache Qpid Broker-J: Unbounded type nesting can lead to sta -
CVE-2026-95844
Moquette deeply nested MQTT topics can cause stack exhaustio -
CVE-2026-78253
Denial-of-service (stack-exhaustion) vulnerability in QXmlSt
V. Comments for CVE-2026-61811
No comments yet