Werk #22116: Agent receiver: limit the size of decompressed push agent data
| Component | Checks & agents | ||||||||
| Title | Agent receiver: limit the size of decompressed push agent data | ||||||||
| Date | Aug 17, 2026 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
Agent data that push hosts send to the agent receiver is zlib compressed, and the receiver decompressed it without any limit on the resulting size. Since compressed data can expand by orders of magnitude, a push host could send a small payload that decompresses to an arbitrary amount of data and exhaust the memory of the agent receiver.
The agent receiver now rejects agent data whose decompressed size exceeds 512 MiB and answers such requests with "Decompression of agent data failed". Agent output of legitimate hosts stays far below that limit, so no reconfiguration is required after updating.
This issue has been discovered and reported by Sven Jäger (SySS GmbH). Thanks!
Who is Affected
Editions that provide the push mode, i.e. Checkmk Ultimate, Ultimate with multi-tenancy, and Checkmk Cloud. Exploiting the issue requires the client certificate of a host that is registered for push mode, so an attacker needs to control such a host.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0
- 2.2.0 (EOL)
Vulnerability Management
We have rated the issue with a CVSS Score of 5.3 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-77021.