The Wazuh Manager authd service accepts SSL/TLS renegotiation requests from clients without imposing limits. An attacker can repeatedly initiate renegotiation, causing the server to consume significant CPU resources and eventually become unresponsive, leading to a denial of service. This weakness allows a remote adversary to disrupt authentication services and potentially impact the overall availability of the Wazuh monitoring stack.

The vulnerability affects the Wazuh Manager (wazuh-manager) product for all versions up to and including 4.7.3. Systems running these versions are susceptible to the DoS condition unless they are upgraded.

The CVSS score of 6.9 indicates a moderate risk. Although EPSS data is not available and the issue is not listed in the CISA KEV catalog, the remote nature of the attack and the lack of mitigations make exploitation plausible. Vulnerable deployments should be considered at high risk until patched or mitigated.