CVE-2026-61811: wazuh Uncontrolled Recursion

Vulnerability summary

CVE-2026-61811 is a medium (CVSS 6.5) Uncontrolled Recursion vulnerability in wazuh. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.7% of scored vulnerabilities.

Timeline

1. 24-09-2026
   PublishedVulnerability first disclosed.
2. 24-09-2026
   Last modifiedVulnerability information updated.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.