Description
Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wazuh | wazuh-manager | ≤ 4.7.3 | 4.8.0 |
Advisories 1
- WID-SEC-2026-0908 Wazuh: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 29, 2026
References
- GitHub Security Advisory (GHSA-rr83-v9v7-jjhp) vendor-advisory
- https://www.vulncheck.com/advisories/ssl-tls-renegotiation-dos-in-wazuh-manager-authd-service third-party-advisory