CVE-2026-61811

Executive Summary

CVE-2026-61811 is an uncontrolled-recursion / stack-exhaustion vulnerability (CWE-674) in Wazuh, the open-source XDR and SIEM platform. From version 3.8.0 through 4.14.6, the _getattributes() function in src/os_xml/os_xml.c recursively processes XML attributes without a depth limit while allocating two large local buffers in every stack frame. A low-privileged, authenticated source — an enrolled Wazuh agent — can submit a Windows EventChannel event containing an element with a sufficiently large number of attributes, exhausting the analysisd worker-thread stack and causing a segmentation fault that interrupts log ingestion. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no confidentiality or integrity loss is described. No public PoC, Nuclei template, or exploit code is known, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The flaw resides in the XML parsing layer of Wazuh, specifically in _getattributes() within src/os_xml/os_xml.c. According to the NVD description, this function "recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame."

Two compounding defects produce the condition:

1. Unbounded recursion (CWE-674). Each attribute encountered drives another recursive call into _getattributes(). There is no maximum recursion depth governing attribute processing, so the call chain grows linearly with the number of attributes present on the parsed element. Because each call consumes a new stack frame, the total stack consumption is proportional to the attacker-controlled attribute count.
2. Large per-frame allocation. Every stack frame for _getattributes() allocates two large local buffers. This dramatically increases the stack cost per recursion level, meaning fewer attributes are required before the thread's stack is exhausted. The combination of unbounded depth and heavy frames converts an operational XML-parsing routine into a stack-exhaustion primitive.

The attacker-controlled input path is a Windows EventChannel event received from an enrolled agent. Wazuh agents forward event data to the manager, where analysisd parses it in worker threads. An event containing an XML element with enough attributes to drive the recursion past the worker thread's stack limit triggers a segmentation fault in the parsing thread.

A critical control gap is explicitly called out in the description: the element-depth limit enforced in _ReadElem() does not constrain the number of attributes on a single element. Therefore the existing depth guard provides no protection — an attacker can place a very large number of attributes on one element at shallow element depth, entirely bypassing the guard. The exhaustion is driven by attribute count, not element nesting depth.

Both denial-of-service preconditions are satisfied by design: the parser must process attacker-influenced XML (the EventChannel payload), and the code path lacks an attribute-count cap. The write-up credits the parsing of agent-submitted events as the trigger vector, which constrains exploitation to actors capable of enrolling or impersonating an agent and sending events to the manager.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-61811; the attack chain below is inferred strictly from the vulnerability class (CWE-674 uncontrolled recursion) and the mechanism stated in the NVD description. No function names beyond those given (_getattributes(), _ReadElem()) and no URL paths, parameters, or endpoints are asserted, because none are specified in the source data.

1) Reconnaissance / target identification. The attacker identifies a Wazuh deployment running an affected version (3.8.0 through 4.14.6) and determines that the agent-to-manager event ingestion path is reachable. Because the CVSS vector is AV:N with PR:L, the adversary requires network reachability to the manager's event ingestion surface and a valid agent identity — i.e., an enrolled agent or the ability to register/enroll one. Public fingerprinting of Wazuh managers (default event ports and the API port) supports discovery.

2) Triggering the specific flaw class. Holding an enrolled agent session, the attacker crafts a Windows EventChannel event whose payload contains an XML element carrying a very large number of attributes. When analysisd parses this event, _getattributes() recurses once per attribute with no attribute-depth cap, and each recursive call consumes a stack frame containing two large local buffers. The element-depth limit in _ReadElem() does not mitigate this, because the malicious attributes are all placed on a single shallow element. Stack consumption therefore scales with the attribute count chosen by the attacker.

3) Payload / execution method at the vulnerability-class level. The delivery vehicle is an agent-submitted event — not an exploit payload in the memory-corruption sense. There is no described use of crafted pointers, no buffer overflow, and no code execution. The "payload" is simply an XML structure with an adversarially large attribute set, which the parser cannot bound. When the accumulated stack frames exceed the worker thread's stack limit, the thread hits a segmentation fault.

4) Post-exploitation impact. The immediate effect is a segmentation fault in the affected analysisd worker thread and interruption of log ingestion. This is a denial-of-service outcome: telemetry stops flowing and detection/alerting is degraded for the duration of the disruption. The CVSS vector (C:N/I:N/A:H) indicates no confidentiality or integrity impact is described; the harm is availability loss. The description does not state that other worker threads, the manager process as a whole, or stored data are corrupted, so broader blast-radius claims should not be inferred. If the crash is repeatable, the attacker can sustain the ingestion outage at will.

Impact Assessment

The blast radius centers on the availability of Wazuh's analysis pipeline. Because analysisd is responsible for processing events forwarded by agents, a crash in a worker thread interrupts log ingestion — meaning SIEM correlation, alerting, and XDR detections that depend on that stream become unreliable or silent. The CVSS subscores make the impact profile explicit: Availability is High (A:H), while Confidentiality (C:N) and Integrity (I:N) are None, and Scope (S:U) is Unchanged. The base score is 6.5, driven by network access (AV:N), low complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N).

Affected systems are Wazuh managers running 3.8.0 through 4.14.6 that ingest Windows EventChannel events from enrolled agents. Organizations relying on Wazuh as their primary detection layer face a monitoring blind spot during the outage: security events may be neither processed nor alerted on while ingestion is interrupted. The low privilege requirement (PR:L) is meaningful in this context — an enrolled agent is a comparatively low-trust role, so an attacker who compromises a single enrolled endpoint or obtains agent credentials can mount the DoS against the central manager. The primary business impacts are degraded detection coverage, delayed incident response, and potential compliance implications where continuous audit logging is required.

Detection Guidance

Sigma Rule

title: Wazuh analysisd XML Attribute Stack Exhaustion (CVE-2026-61811)
id: 8b1f4c2e-6a7d-4f3b-9c21-0b7e5d9a1f34
status: experimental
description: Detects XML EventChannel payloads with an abnormally large number of attributes on a single element, consistent with the attribute-recursion stack exhaustion described in CVE-2026-61811.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61811
author: valtersit.com TI
date: 2026-01-01
logsource:
  product: wazuh
  service: analysisd
detection:
  selection_attr_burst:
    keywords|re: '<[A-Za-z0-9_:\-]+(\s+[A-Za-z0-9_:\-]+\s*=\s*"[^"]*"){50,}'
  condition: selection_attr_burst
falsepositives:
  - Legitimate XML documents with unusually wide elements (rare in EventChannel events)
level: high
tags:
  - attack.t1499
  - cve.2026-61811

YARA Rule

rule Wazuh_XML_Attribute_Stack_Exhaustion_CVE_2026_61811
{
    meta:
        author = "valtersit.com TI"
        description = "Detects XML elements with excessive attribute counts targeting Wazuh analysisd _getattributes() recursion (CVE-2026-61811)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61811"
        cve = "CVE-2026-61811"
        date = "2026-01-01"

    strings:
        $xml_open = "<"
        $attr_a = /[A-Za-z0-9_:\-]+[ ]*=[ ]*"[^"]{0,64}"/

    condition:
        $xml_open and #attr_a >= 50
}

Suricata IDS Rule

alert tcp any any -> any 1514 (msg:"CVE-2026-61811 Wazuh agent event with excessive XML attributes (possible analysisd stack exhaustion)"; flow:established,to_server; content:"<"; depth:0; pcre:"/<[A-Za-z0-9_:\-]+(?:\s+[A-Za-z0-9_:\-]+\s*=\s*\"[^\"]*\"){50,}/s"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:202661811; rev:1; reference:cve,2026-61811;)

Elastic Detection

sequence by host.name, process.pid with maxspan=5s
  [process where event.category == "process" and process.name == "wazuh-analysisd" and process.thread.stack_exhausted == true]
  [process where event.category == "process" and process.name == "wazuh-analysisd" and (process.exit_code != 0 or event.type == "process_crash")]

Splunk SPL Query

index=wazuh sourcetype=wazuh:analysisd OR sourcetype=wazuh:alerts
| regex _raw="<[A-Za-z0-9_:\-]+(\s+[A-Za-z0-9_:\-]+\s*=\s*\"[^\"]*\"){50,}"
| eval attr_count=len(_raw)
| stats count, max(attr_count) AS max_len, dc(agent.name) AS agents BY agent.name, src_ip
| where count >= 1
| sort - max_len

Wazuh OSSEC Rule

<group name="wazuh,syscheck,">
  <rule id="100811" level="12">
    <decoded_as>wazuh-events</decoded_as>
    <match>EventChannel</match>
    <regex type="pcre2">"<[A-Za-z0-9_:\-]+(?:\s+[A-Za-z0-9_:\-]+\s*=\s*\"[^\"]*\"){50,}"</regex>
    <description>CVE-2026-61811: agent event contains element with excessive attributes (possible analysisd stack exhaustion DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_61811,attack_dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 4.14.7, but no vendor advisory, commit reference, or OSV entry is tracked in this dataset, and affected-version ranges and vendor workarounds are not supplied. Treat the 4.14.7 target defensively and verify independently.

1. Immediate mitigations
   • Where operationally feasible, restrict which agents can reach the manager's event ingestion surface, and audit agent enrollment — the trigger requires PR:L (a valid/enrolled agent), so tightening enrollment and enrollment-secret handling reduces the threat.
   • Filter or normalize inbound agent events: reject or truncate events containing elements with abnormally high attribute counts before they reach the XML parser. This can be implemented at a broker/proxy in front of the ingestion port(s).
   • Monitor for rapid analysisd thread crashes / segmentation faults and ingestion gaps as a sign the condition is being triggered.
   • Because the element-depth limit in _ReadElem() explicitly does not mitigate this issue, do not rely on existing element-nesting-depth configuration or hardening as a workaround.
   • In the absence of a confirmed vendor patch, treat upstream release notes and advisories as unverified until validated against the vendor's official channel.
2. Patch / upgrade steps
   • Plan an upgrade to Wazuh 4.14.7 (or later), per the NVD description, following your standard change-management process on the manager tier. Back up configurations and validate the analysisd pipeline (event ingestion, decoders, rules) after upgrade.
   • If 4.14.7 availability or integrity cannot be independently confirmed, do not assume the gap is closed; consult the vendor's official release/advisory channel and re-evaluate.
3. Long-term hardening
   • Enforce resource limits on parsing worker threads (stack size ceilings, resource-accounting) so that a single malformed event cannot exhaust a thread's stack.
   • Require an attribute-count cap and recursion-depth bounds in all XML parsing paths, and add malformed-input test coverage to the agent-event processing pipeline.
   • Harden agent onboarding and secrets so an attacker cannot trivially obtain the low-privileged agent role the exploit depends on.
   • Maintain centralized, immutable logging so that detection coverage gaps during an ingestion outage are themselves detectable.

References

• NVD — CVE-2026-61811: https://nvd.nist.gov/vuln/detail/CVE-2026-61811
• CWE-674 (Uncontrolled Recursion): https://cwe.mitre.org/data/definitions/674.html
• Wazuh project / source repository (product context; no patch commit tracked in this dataset): https://github.com/wazuh/wazuh
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-61811 is not listed as of this report.

No threat-actor campaign, exploit-in-the-wild evidence, public PoC, Nuclei template, or exploit code is known for CVE-2026-61811 based on the provided data.