CVE-2026-32983 MEDIUM

CVE-2026-32983: SSL/TLS Renegotiation DoS in Wazuh Manager authd service

Vendor Wazuh
Product wazuh-manager
Weakness CWE-276
Published March 27, 2026
Last update May 12, 2026

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

What the vulnerability does

01Description

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.

Key dates

02Disclosure timeline

March 27, 2026 CVE published
May 12, 2026 Record updated