CVE-2026-25771: Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware

Vulnerability summary

CVE-2026-25771 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in wazuh. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-03-2026
   PublishedVulnerability first disclosed.
2. 18-03-2026
   Last modifiedVulnerability information updated.

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version 4.14.3, a Denial of Service (DoS) vulnerability exists in the Wazuh API authentication middleware (`middlewares.py`). The application uses an asynchronous event loop (Starlette/Asyncio) to call a synchronous function (`generate_keypair`) that performs blocking disk I/O on every request containing a Bearer token. An unauthenticated remote attacker can exploit this by flooding the API with requests containing invalid Bearer tokens. This forces the single-threaded event loop to pause for file read operations repeatedly, starving the application of CPU resources and potentially preventing it from accepting or processing legitimate connections. Version 4.14.3 fixes the issue.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.