CVE-2026-61811

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.

• CWE-674

• https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67
• https://github.com/wazuh/wazuh/pull/37147
• https://github.com/wazuh/wazuh/releases/tag/v4.14.7
• https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5
• https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5

Published

Sep 24, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61805Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.1
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-61810libspdm is a sample implementation that follows the DMTF SPD…6
• CVE-2026-61812ModSecurity is an open source, cross platform web applicatio…6.3
• CVE-2026-61813ModSecurity is an open source, cross platform web applicatio…3.7
• CVE-2026-61814Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's A…7.5
• CVE-2026-61815zbateson/mail-mime-parser is a mail mime parser alternative …7.2
• CVE-2026-61816zbateson/mail-mime-parser is a mail mime parser alternative …7.5
• CVE-2026-61817pg_partman is a PostgreSQL extension that manages partitione…8.5