CVE details
CVE-2026-74039
Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.
- Score
- 7.1 high
- Published
- 2026-08-18
- Links
- NVD · cve.org · Report wrong data
Matched ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| security/wazuh-agent | wazuh-agent | 4.14.9 | fixed by update | acm@FreeBSD.org |
| security/wazuh-manager | wazuh-manager | 4.14.9 | fixed by update | acm@FreeBSD.org |