Wazuh SCA YAML Alias Expansion OOM Vulnerability (CVE-2026-74030) with PoC

Vulnerability Overview Vulnerability Name: SCA YAML alias expansion causes memory exhaustion CVE ID: CVE-2026-74030 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High Description: SCA policy YAML files do not impose any limits on alias expansion, recursion depth, or final output size during parsing. A 394-byte input can expand into 234,583 JSON nodes and 2.1 MB of printed JSON. A 573-byte input can consume 1 GB of resident set memory and result in 23.4 million node accesses. During a conversation, a manager pushing a policy of this size OOM-killed every agent. There are no agent-side flags to prevent this attack: the YAML parser runs before any or rule evaluation. Scope of Impact Affected Versions: - : >= 3.9.0 - : >= 3.9.0 Fixed Versions: - : 4.14.8 - : 4.14.8 Impact: - A single manager-controlled YAML file of approximately 1 KB can reliably trigger a 1 GB allocation on each agent. - The attack affects every agent within the target group. Recovery requires manual policy remediation and agent restart. - No authentication or encryption gate is compromised; the impact is a denial of service for agent monitoring. - An attacker can leverage this vulnerability to permanently silence an agent's telemetry data. Remediation 1. Reject alias references during parsing: A simple implementation calculates the ratio of distinct nodes to total node accesses. If the total access count exceeds (e.g.) ten times the distinct count, reject the loading. The correct fix involves traversing the document, using a visited set to deduplicate (returning the same JSON subtree), or rejecting if the total access count exceeds document boundaries. 2. Limit recursion depth in : For example, cap it at 64, and limit the cumulative JSON allocation count per call. If either condition is exceeded, continue and return , allowing the caller to skip the policy. 3. Limit input file size before parsing: SCA policies are typically in KB sizes; reject any file exceeding 1 MB. Since already takes a path, use first. 4. Completely disable YAML aliases in SCA policies: Aliases are not used in any distributed Wazuh policy files. Disable them in the parser, or the caller can reject any document reported by as containing alias nodes. 5. Sign or hash policies in : This prevents hijacked manager sessions from pushing poisoned policies. This is a defense-in-depth measure; the parser fix is still required. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Wazuh SCA YAML Alias Expansion OOM Vulnerability (CVE-2026-74030) with PoC

More from this source