CVE-2026-25771

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service (DoS) vulnerability exists in the Wazuh API authentication middleware (`middlewares.py`). The application uses an asynchronous event loop (Starlette/Asyncio) to call a synchronous function (`generate_keypair`) that performs blocking disk I/O on every request containing a Bearer token. An unauthenticated remote attacker can exploit this by flooding the API with requests containing invalid Bearer tokens. This forces the single-threaded event loop to pause for file read operations repeatedly, starving the application of CPU resources and potentially preventing it from accepting or processing legitimate connections. Version 4.14.3 fixes the issue.

• CWE-400

• https://github.com/wazuh/wazuh/security/advisories/GHSA-33w3-p5hm-jw7gExploit, Mitigation, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10
• CVE-2026-25770Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25772Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25773** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails…6.5
• CVE-2026-25774Charging station authentication identifiers are publicly acc…5.3
• CVE-2026-25775A vulnerability in SenseLive X3050’s remote management servi…9.8
• CVE-2026-25776Movable Type provided by Six Apart Ltd. contains a code inje…9.8
• CVE-2026-25778The WebSocket backend uses charging station identifiers to u…7.5