The vulnerability resides in the Wazuh cluster manager where an unauthenticated network peer can send a 20-byte cluster protocol header that declares a payload size of up to 256 MiB before the data is authenticated by Fernet decryption. The listener then allocates a buffer of that declared size and keeps the memory allocated until the TCP connection is closed, even if the peer stops sending data. This allows an attacker to exhaust the memory of the wazuh‑clusterd process, potentially terminating the cluster manager, disrupting synchronization, and interrupting distributed API forwarding.

The issue affects Wazuh Manager and the wazuh‑clusterd component in versions from 3.9.0 up to and including 4.14.7. Vendors and products are listed as wazuh:wazuh.

The CVSS score is 7.5, indicating high severity. EPSS data is not available, so exploitation likelihood cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the cluster interface over the network without authentication, send the malicious header, and trigger memory exhaustion. An affected system with multiple simultaneous connections could experience exponential memory consumption leading to denial of service.