CVE-2026-34150: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-34150 is a heap-based buffer overflow vulnerability in the wazuh-analysisd component of the Wazuh SIEM platform that allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing a complete loss of SIEM alert processing. It affects Wazuh versions 1.0.0 through 4.14.4 (all versions prior to 4.14.5), including deployments using the official wazuh/wazuh-docker image with default configuration. The vulnerability was published on July 16–17, 2026, with a patch released in version 4.14.5. It carries a CVSS v3.1 base score of 7.5 (High) (Wazuh Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in the W_JSON_ParseRootcheck() function within src/analysisd/format/json_extended.c. The function allocates 30-byte heap buffers (MAX_STRING_LESS = 30) to store regex-matched compliance references (e.g., {CIS: 1.1.2 RHEL7}) from rootcheck events, but uses an unbounded sprintf call at line 631 to write matched content into these fixed-size buffers — if the captured {key: value} pattern exceeds 30 bytes, the write overflows the buffer and corrupts adjacent heap memory. The attack is enabled by the default wazuh/wazuh-docker configuration, which ships with <auth><use_password>no</use_password></auth>, allowing unauthenticated agent enrollment via authd (port 1515/TLS) to obtain a valid agent ID and encryption key. The attacker then connects to remoted (port 1514/TCP) using the Wazuh agent protocol (Blowfish-CBC encrypted, zlib compressed) and injects crafted rootcheck events that trigger the overflow. A complete, runnable PoC in C is included in the official advisory (Wazuh Advisory).

Successful exploitation causes wazuh-analysisd to crash, resulting in a complete and silent loss of all SIEM alert processing — security events from all monitored agents are silently dropped with no alerting. The crash is particularly dangerous because the Wazuh dashboard, REST API, and container remain operational and continue displaying stale data, giving operators a false sense of security. An attacker can exploit this to blind the SIEM before conducting further attacks on monitored infrastructure, and the crash is repeatable — the attacker can re-trigger it immediately after any manual restart. There is no confidentiality or integrity impact; the sole consequence is high availability impact to the security monitoring function (Wazuh Advisory).

1. Reconnaissance: Identify internet-facing Wazuh manager instances running versions 1.0.0–4.14.4, particularly those deployed via wazuh/wazuh-docker with default configuration. Scan for open ports 1514 (remoted) and 1515 (authd/TLS) using tools like Shodan, Censys, or nmap.
2. Compile the PoC: Obtain the poc.c exploit from the public advisory. Compile it with gcc -o poc poc.c -lssl -lcrypto -lz on a Debian/Ubuntu system with libssl-dev and zlib1g-dev installed.
3. Unauthenticated agent enrollment: The PoC connects to authd on port 1515 via TLS and sends an enrollment request (OSSEC A:'<name>' 'any') without a password. The default configuration (<use_password>no</use_password>) allows this, returning a valid agent ID and encryption key.
4. Key derivation: Derive the session encryption key from the agent ID, name, and raw key using the same MD5-based key derivation logic as the Wazuh source (OS_AddKey).
5. Wait for key reload: Sleep ~5 seconds to allow remoted to reload the newly enrolled agent's keys.
6. Connect to remoted: Establish a TCP connection to port 1514 and send an agent startup message encrypted with Blowfish-CBC and compressed with zlib, formatted as a standard Wazuh agent protocol frame (4-byte LE length prefix).
7. Inject overflow payloads: Send 20 rootcheck events (message type 9) containing {key: value} patterns where both key and value are 200 characters each (402 bytes total, far exceeding the 30-byte buffer). Each event is encrypted and framed per the Wazuh protocol.
8. Crash wazuh-analysisd: The events match rootcheck rules (509–520), triggering JSON output processing. W_JSON_ParseRootcheck calls sprintf which overflows the 30-byte heap buffer, corrupting heap memory and crashing wazuh-analysisd. All SIEM alert processing silently stops (Wazuh Advisory).

• Network: Unexpected TLS connections to authd (port 1515) from unknown or external IP addresses, particularly with agent names matching the pattern dos-NNNNN; TCP connections to remoted (port 1514) from IPs not corresponding to known deployed agents; high-frequency rootcheck event submissions from a newly enrolled agent.
• Logs: Wazuh ossec.log entries showing wazuh-remoted: ERROR: (1210): Queue 'queue/sockets/queue' not accessible: 'Connection refused' — indicating wazuh-analysisd has crashed; agent enrollment log entries for agents with randomized names (e.g., dos-NNNNN) from unexpected source IPs in /var/ossec/logs/ossec.log.
• Process: Absence of the wazuh-analysisd process (verifiable via ps aux | grep analysisd) while the Wazuh dashboard and API remain responsive; unexpected process termination events for wazuh-analysisd in system logs.
• File System: No persistent file artifacts are expected from this DoS-only exploit; however, core dump files from wazuh-analysisd may appear in the Wazuh working directory if core dumps are enabled (Wazuh Advisory).

Upgrade Wazuh to version 4.14.5 or later, which replaces the unbounded sprintf at line 631 of src/analysisd/format/json_extended.c with a bounds-checked snprintf and adds a totalResults bounds check. As an immediate workaround, enable agent enrollment password authentication by setting <use_password>yes</use_password> in ossec.conf — this prevents unauthenticated agent enrollment and blocks the attack chain. Additionally, restrict network access to ports 1514 and 1515 to only trusted agent IP ranges using firewall rules. Organizations using the wazuh/wazuh-docker deployment should prioritize patching, as the default configuration is directly exploitable (Wazuh Advisory).