CVE-2026-74039 - Wazuh 4.0.0 4.14.7 API DoS via Deeply Nested JSON auth_context
Brief
CVE ID : CVE-2026-74039
Published : Aug. 18, 2026, 6:19 p. m.
- 48 minutes ago
Description : Wazuh 4.
- 0 before 4.
- 7 and 5.
- 0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint.
Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.
Severity: 7.1
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...