CVE-2026-77021— Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
Quick assessment
Affected
Checkmk GmbH Checkmk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib comp
Affected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0< 2.5.0p14 |
affected |
2.4.0< 2.4.0p37 |
affected | ||
2.3.0< 2.3.0p51 |
affected | ||
2.2.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77021
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
Source: CVE Program / CVE List V5
Vulnerability Description
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0 ~ 2.5.0p14 | - |
|
II. Public POCs for CVE-2026-77021
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77021
请登录查看更多情报信息。
Other References for CVE-2026-77021 (1)
IV. Related Vulnerabilities
Same product: Checkmk
-
CVE-2026-90990
Livestatus injection via monitoring filter values -
CVE-2026-92882
Redact SNMP community, SNMPv3 pass phrases, and IPMI passwor -
CVE-2026-15937
Agent receiver certificate confusion allows authentication w -
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-15576
Agent receiver accepts mTLS requests without a client certif
Same vendor: Checkmk GmbH
-
CVE-2026-90990
Livestatus injection via monitoring filter values -
CVE-2026-92882
Redact SNMP community, SNMPv3 pass phrases, and IPMI passwor -
CVE-2026-15937
Agent receiver certificate confusion allows authentication w -
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-15576
Agent receiver accepts mTLS requests without a client certif
Same weakness: CWE-409
-
CVE-2026-83599
Netdata: WebSocket Decompression Bomb -
CVE-2026-77620
Vector: Unauthenticated denial of service in the `logstash` -
CVE-2026-47321
Apache MINA: Unbounded Decompression Amplification DoS in Zl -
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloa -
CVE-2026-84384
libheif: brotli/zlib decompression paths lack output-size li
V. Comments for CVE-2026-77021
No comments yet