Wazuh Manager versions 3.0.0 through 4.14.8 contain a memory leak in the generic JSON decoder. The flaw allows a remote attacker to repeatedly send events that contain duplicate static fields, such as duplicated "id" fields, causing the wazuh-analysisd process to consume increasing amounts of memory until it is killed by the operating system for an out‑of‑memory condition. When wazuh-analysisd is terminated, the alerting component stops functioning, resulting in a denial of service for the management infrastructure.

Vulnerable installations are those running Wazuh Manager in the 3.0.0 to 4.14.8 release line. The advisory specifically targets the wazuh:wazuh product as identified by its CPE. Any Wazuh Manager host that has not been updated to version 4.14.9 or later is at risk.

The CVSS score of 7.1 places this issue in the high severity range. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that public exploitation may be limited at present. However, the attack can be performed remotely by launching a passwordless agent enrollment and submitting maliciously crafted events. The lack of a publicly available exploit does not remove the immediate risk, because an attacker who gains network access to the manager can trigger the memory exhaustion and disrupt operations.