What is CVE-2026-61811?

CVE-2026-61811 is a medium-severity vulnerability in Wazuh, classified under Uncontrolled Recursion. CVSS score: 6.5/10. Published 2026-09-24.

How severe is CVE-2026-61811?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Wazuh

CVE-2026-61811

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.

Published 2026-09-24 · last modified 2026-09-24.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wazuh — versions >= 3.8.0, < 4.14.7

Weakness classification (CWE)

CWE-674 — Uncontrolled Recursion

References

Frequently asked questions

What is CVE-2026-61811?: CVE-2026-61811 is a medium-severity vulnerability in Wazuh, classified under Uncontrolled Recursion. CVSS score: 6.5/10. Published 2026-09-24.
How severe is CVE-2026-61811?: Medium severity. CVSS v3 base score is 6.5 out of 10.