The wazuh-manager authd service accepts client‑initiated SSL/TLS renegotiation without enforcing limits, allowing a remote attacker to flood the service with renegotiation requests. Each request consumes CPU and memory, eventually exhausting resources and causing the authentication daemon to become unavailable. This flaw results in denial of service for all authentication operations that rely on the authd service.

The vulnerability affects the Wazuh wazuh-manager component, specifically all releases through version 4.7.3. Systems running the 4.7.3 or earlier packages are susceptible; versions newer than 4.7.3 are not listed as impacted.

The flaw receives a CVSS base score of 6.9, indicating moderate severity. The exploitation probability estimate is below 1%, suggesting a low probability of exploitation, and it is not included in CISA’s KEV catalog. Attackers can exploit the weakness remotely by initiating TLS renegotiation requests over the network. Because the flaw resides in the authentication service, successful exploitation results in a denial of service that affects all users who rely on the wazuh-manager for authentication.