An authenticated cluster node can exploit Wazuh's receive_str() method by requesting an arbitrarily large bytearray, causing unbounded memory allocation on the master node. The size of the requested data directly increases memory consumption; repeated requests accumulate unbounded flag_divided fragments under unique counters in div_msg_box, which also lack size or expiration controls. Together, these weaknesses can exhaust master memory, crash the master node, and disrupt agent connectivity and alert processing across the monitored environment.

Versions of Wazuh from 3.9.0 up to 4.14.5 and 5.0.0-beta2 are affected. The issue resides in framework/wazuh/core/cluster/common.py and can impact any deployment using the cluster protocol.

The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of < 1% indicates a very low but nonzero exploitation probability, suggesting exploitation likelihood has not been quantified publicly. The vulnerability is not listed in CISA KEV, and the attack requires an authenticated cluster node to send crafted requests. If successful, a cluster node could exhaust master memory, leading to denial of service for the entire cluster.