Wazuh versions 3.9.0 through 4.14.7 contain an uncontrolled YAML alias expansion flaw in the yaml2json_node component. An attacker who can control a Wazuh manager can upload a small SCA policy containing deeply nested aliases via the merged.mg endpoint. When the policy is applied, the agent translates it into JSON, expanding the YAML aliases until the agent’s memory is exhausted and the wazuh-modulesd process is terminated. The vulnerability is a classic denial‑of‑service attack that does not provide direct remote code execution. The weakness is classified as CWE‑776, indicating an uncontrolled resource consumption flaw.

All Wazuh deployments that use versions 3.9.0 up to 4.14.7 for both the wazuh-agent and wazuh-manager are impacted. The problem occurs when a manager pushes SCA policies to any agent that is part of a group, regardless of the agent’s location or host operating system. Updating to version 4.14.8 or later removes the yaml2json_node code path that allows large alias expansions.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, but the threat remains significant for environments where the manager is compromised or controlled by insiders, as the attacker can force OOM kills on all agents in a selected group. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been publicly exploited at large scale. The attack vector is inferred to be via the manager’s policy submission API, allowing an attacker with manager privileges to trigger the denial of service.