High · published October 29, 2025
⚠️ A single NULL time_string is all it takes to send Wazuh's analysisd crashing down! 🚨 Think of this vulnerability like a restaurant that doesn’t check if a customer’s order includes all necessary ingredients. If a chef gets a request without checking, they could serve an incomplete dish, resulting in an unhappy dining experience—and in this case, a crashed service! An attacker who sends a specially crafted message can cause the analysis engine to crash, making the system unavailable. This could disrupt incident response efforts, leaving your security posture vulnerable. While it sounds sneaky, the reality is that it could lead to downtime when you need detection the most!
Think of this vulnerability like a restaurant that doesn’t check if a customer’s order includes all necessary ingredients. If a chef gets a request without checking, they could serve an incomplete dish, resulting in an unhappy dining experience—and in this case, a crashed service! This vulnerability stems from the fim_fetch_attributes_state() function in Wazuh, which fails to check if the time_string is NULL before calling strlen(). This oversight can be exploited by a compromised agent to crash the analysisd process.
An attacker who sends a specially crafted message can cause the analysis engine to crash, making the system unavailable. This could disrupt incident response efforts, leaving your security posture vulnerable. While it sounds sneaky, the reality is that it could lead to downtime when you need detection the most! To remediate this vulnerability, upgrade to Wazuh version 4.11.0 or later. Additionally, conduct a review of your agent message handling to ensure proper validation of incoming messages. You've got this! By updating your Wazuh installation, you'll boost your defenses and keep your security engine running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wazuh/wazuh | < 4.11.0 | 4.11.0 |