The vulnerability lies in the fdecompress_files() function within cluster.py. A malicious, highly compressed zip bomb can be uploaded by a cluster peer that holds a valid Fernet key. When the master node decompresses the archive, it loads the entire payload into memory, exhausting available memory and causing a denial of service. The weakness is a lack of decompression size limits and improper validation of compressed data, classified as CWE-409. Attackers with cluster authentication can force this denial, impacting availability of wazuh-clusterd and potentially the entire cluster.

Affected product is Wazuh Manager version 4.4.0 up to, but not including, 4.14.7. The product is part of the Wazuh security monitoring platform, used in distributed cluster deployments. Any installation that relies on clustering and uses the default Fernet-based authentication with the pre-4.14.7 package may be vulnerable.

The CVSS score of 6.9 indicates a medium severity. EPSS is not available, so exploitation likelihood cannot be precisely quantified, though the need for a valid cluster key reduces the exposed threat surface. Since the vulnerability is not listed in the CISA KEV catalog, there is no widespread exploitation yet. The attack path requires an attacker to obtain or compromise a cluster Fernet key, which may be achieved through insider knowledge or side‑channel attacks. Once the key is in hand, the attacker can upload a small zip bomb to any authorised peer connection, forcing memory exhaustion on the master node. The lack of size checks and the automatic decompression trigger a resource exhaustion condition that disconnects the cluster and disrupts processing of further alerts.