CVE-2025-15615

Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

Published Mar 27, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.

Analysis

Technical impact

The wazuh-manager authd service accepts client‑initiated SSL/TLS renegotiation without enforcing limits, allowing a remote attacker to flood the service with renegotiation requests. Each request consumes CPU and memory, eventually exhausting resources and causing the authentication daemon to become unavailable. This flaw results in denial of service for all authentication operations that rely on the authd service.

Affected Systems

The vulnerability affects the Wazuh wazuh-manager component, specifically all releases through version 4.7.3. Systems running the 4.7.3 or earlier packages are susceptible; versions newer than 4.7.3 are not listed as impacted.

Risk and Exploitability

The flaw receives a CVSS base score of 6.9, indicating moderate severity. The exploitation probability estimate is below 1%, suggesting a low probability of exploitation, and it is not included in CISA’s KEV catalog. Attackers can exploit the weakness remotely by initiating TLS renegotiation requests over the network. Because the flaw resides in the authentication service, successful exploitation results in a denial of service that affects all users who rely on the wazuh-manager for authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Wazuh

wazuh-manager

unaffected

Version	Status	Constraints
`<= 4.7.3`	affected	—
`>= 4.8.0`	unaffected	—

Wazuh

wazuh-manager

unaffected

Version	Status	Constraints
`<= 4.7.3`	affected	—
`>= 4.8.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Wazuh

Wazuh-manager

Version	Status	Scheme	Platform
`[0,4.7.3]`	affected	semver	—
`[4.8.0,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify the wazuh-manager package version and upgrade to a fixed release newer than 4.7.3.
If an update is not immediately available, reconfigure the authentication service or network devices to disable or restrict client‑initiated TLS renegotiation.
Implement firewall rules to limit traffic to the authd service and monitor for sudden increases in CPU usage or connection attempts.
Keep the system updated with the latest vendor advisories and apply any published mitigations promptly.

Generated by OpenCVE AI on March 31, 2026 at 19:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.528% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-rr83-v9v7-jjhp
https://www.vulncheck.com/advisories/ssl-tls-renegotiation-dos-in-wazuh-manager-authd-service

History

May 12, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}`

Mar 31, 2026 6:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh wazuh
CPEs		cpe:2.3:a:wazuh:wazuh::::::::
Vendors & Products		Wazuh wazuh

Mar 30, 2026 7:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh Wazuh wazuh-manager
Vendors & Products		Wazuh Wazuh wazuh-manager

Mar 27, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 27, 2026 8:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	SSL/TLS Renegotiation DoS in Wazuh Manager authd service	Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

Mar 27, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.
Title		SSL/TLS Renegotiation DoS in Wazuh Manager authd service
Weaknesses		CWE-276
References		https://github.com/wazuh/wazuh/security/advisories/GHSA-rr83-v9v7-jjhp https://www.vulncheck.com/advisories/ssl-tls-renegotiation-dos-in-wazuh-manager-authd-service
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L'}`