What is CVE-2026-112336?

CVE-2026-112336 is a medium-severity vulnerability in Wazuh, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2026-11-06.

How severe is CVE-2026-112336?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Wazuh

CVE-2026-112336

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

Published 2026-11-06 · last modified 2026-11-06.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wazuh

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

Patch Commit (patch)
Patch Commit (patch)
wazuh v4.14.9 Release Notes (release-notes)
GitHub Security Advisory (GHSA-6w6h-fwqm-6hjj) (vendor-advisory)
VulnCheck Advisory: Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder (third-party-advisory)

Frequently asked questions

What is CVE-2026-112336?: CVE-2026-112336 is a medium-severity vulnerability in Wazuh, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2026-11-06.
How severe is CVE-2026-112336?: Medium severity. CVSS v3 base score is 6.5 out of 10.