Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-77021

Missing decompression size limit in agent receiver allows memory exhaustion via push agent data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Checkmk

Description

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Checkmk GmbH Checkmk

Default version status: unaffected

  • 2.5.0 to < 2.5.0p14affected
  • 2.4.0 to < 2.4.0p37affected
  • 2.3.0 to < 2.3.0p51affected
  • 2.2.0affected

References