# Wazuh changelog

> The open-source security platform.

- Vendor: Wazuh
- Category: Developer Tools
- Official site: https://wazuh.com
- Tracked by: What's New (https://whatsnew.fyi/product/wazuh)
- Harvested from: GitHub (wazuh/wazuh)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v4.14.7 — Wazuh v4.14.7

- Date: 2026-07-30
- Version: v4.14.7
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.14.7
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.14.7

- **removed** — Remove deprecated wazuh-dbd daemon and database_output configuration
- **fixed** — Improve cluster payload buffer allocation strategy
- **fixed** — Improve cluster archive decompression limits
- **fixed** — Improve cluster worker file path validation
- **fixed** — Improve API authentication stability with bounded thread pools, regex timeouts and payload size limits
- **changed** — Update aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies
- **fixed** — Fix AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations
- **fixed** — Fix agent keepalive scheduling after a system clock rollback causing false Disconnected status
- **fixed** — Fix eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023
- **fixed** — Fix eBPF FIM whodata missing file move/rename events into monitored folders
- **added** — Add IP address validation to the ip-customblock active response to prevent malformed input in file path operations
- **added** — Add a null check for inode and device fields in the FIM whodata event handler
- **fixed** — Fix multiple Debian, Ubuntu and Windows SCA checks generating incorrect results
- **fixed** — Fix a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive
- **fixed** — Fix the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling
- **fixed** — Fix the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition
- **fixed** — Fix a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion
- **fixed** — Fix TypeError when sorting agents by version with empty version strings
- **fixed** — Improve sensitive data masking in cluster configuration endpoint

###### Manager

###### Removed

- Removed deprecated wazuh-dbd daemon and database_output configuration. ([#37035](https://github.com/wazuh/wazuh/pull/37035))

###### Fixed

- Improved cluster payload buffer allocation strategy. ([#37280](https://github.com/wazuh/wazuh/pull/37280))
- Improved cluster archive decompression limits. ([#37119](https://github.com/wazuh/wazuh/pull/37119))
- Improved cluster worker file path validation. ([#36998](https://github.com/wazuh/wazuh/pull/36998))
- Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. ([#37034](https://github.com/wazuh/wazuh/pull/37034))
- Updated `aiohttp`, `cryptography`, `PyJWT`, `python-multipart` and `starlette` Python dependencies. ([#37361](https://github.com/wazuh/wazuh/pull/37361))

###### Agent

###### Fixed

- Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account `iam_role_arn` configurations. ([#36791](https://github.com/wazuh/wazuh/pull/36791))
- Fixed agent keepalive scheduling after a system clock rollback causing false `Disconnected` status. ([#36338](https://github.com/wazuh/wazuh/pull/36338))
- Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. ([#37014](https://github.com/wazuh/wazuh/pull/37014))
- Fixed eBPF FIM whodata missing file move/rename events into monitored folders. ([#37023](https://github.com/wazuh/wazuh/pull/37023))
- Added IP address validation to the `ip-customblock` active response to prevent malformed input in file path operations. ([#36730](https://github.com/wazuh/wazuh/pull/36730))
- Added a null check for inode and device fields in the FIM whodata event handler. ([#37245](https://github.com/wazuh/wazuh/pull/37245))


###### Ruleset

###### Fixed

- Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. ([#37385](https://github.com/wazuh/wazuh/pull/37385))
- Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as `permissive`. ([#36361](https://github.com/wazuh/wazuh/pull/36361))
- Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. ([#36396](https://github.com/wazuh/wazuh/pull/36396))
- Fixed the `/etc/gshadow-` permissions SCA check always failing due to an incorrect `all` condition. ([#36795](https://github.com/wazuh/wazuh/pull/36795))
- Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in `sh -c` for glob expansion. ([#36783](https://github.com/wazuh/wazuh/pull/36783))

###### RESTful API

###### Fixed

- Fixed TypeError when sorting agents by version with empty version strings. ([#37323](https://github.com/wazuh/wazuh/pull/37323))
- Improved sensitive data masking in cluster configuration endpoint. ([#37039](https://github.com/wazuh/wazuh/pull/37039))

### v4.10.4 — Wazuh v4.10.4

- Date: 2026-07-30
- Version: v4.10.4
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.10.4
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.10.4

- **changed** — Masked authd.pass in configuration API responses for users without update permissions
- **fixed** — Fixed analysisd plugin decoder argument alignment
- **security** — Fixed path traversal in authd via agent group name validation
- **security** — Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling
- **security** — Fixed DAPI callable resolution to restrict invocations to exposed resources only
- **fixed** — Fixed admin protection in update user endpoint
- **fixed** — Fixed protected settings checks when multiple ossec_config blocks are present
- **security** — Restricted cluster file transfer write paths
- **fixed** — Improved cluster file synchronization path handling by adding safe path joins
- **fixed** — Fixed Vulnerability Detector offset DB update to occur only after processing
- **added** — Added detection of the -a never,task Audit rule in FIM whodata for Linux
- **changed** — Changed sync primitive disposal to stop and soften teardown failures
- **fixed** — Fixed Windows FIM Registry scan crash on non-null-terminated values
- **changed** — Updated curl dependency to 8.12.1
- **changed** — Updated starlette dependency to 0.49.1
- **changed** — Upgraded Python embedded interpreter to 3.10.19

##### Manager

###### Changed

- Masked `authd.pass` in configuration API responses for users without update permissions. ([#34128](https://github.com/wazuh/wazuh/pull/34128))

###### Fixed

- Fixed analysisd plugin decoder argument alignment. ([#35222](https://github.com/wazuh/wazuh/pull/35222))
- Fixed path traversal in authd via agent group name validation. ([#35258](https://github.com/wazuh/wazuh/pull/35258))
- Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. ([#35256](https://github.com/wazuh/wazuh/pull/35256))
- Fixed DAPI callable resolution to restrict invocations to exposed resources only. ([#35256](https://github.com/wazuh/wazuh/pull/35256))
- Fixed admin protection in update user endpoint. ([#35469](https://github.com/wazuh/wazuh/pull/35469))
- Fixed protected settings checks when multiple `<ossec_config>` blocks are present. ([#34690](https://github.com/wazuh/wazuh/pull/34690))
- Restricted cluster file transfer write paths. ([#34659](https://github.com/wazuh/wazuh/pull/34659))
- Improved cluster file synchronization path handling by adding safe path joins. ([#35008](https://github.com/wazuh/wazuh/pull/35008))
- Fixed Vulnerability Detector offset DB update to occur only after processing (backport from 4.12.0). ([#31901](https://github.com/wazuh/wazuh/pull/31901))

##### Agent

###### Added

- Added detection of the `-a never,task` Audit rule in FIM whodata for Linux. ([#34661](https://github.com/wazuh/wazuh/pull/34661))

###### Changed

- Changed sync primitive disposal to stop and soften teardown failures. ([#34680](https://github.com/wazuh/wazuh/pull/34680))

###### Fixed

- Fixed Windows FIM Registry scan crash on non-null-terminated values. ([#34679](https://github.com/wazuh/wazuh/pull/34679))

##### Other

###### Changed

- Updated curl dependency to 8.12.1. ([#34687](https://github.com/wazuh/wazuh/pull/34687))
- Updated `starlette` dependency to 0.49.1. ([#33383](https://github.com/wazuh/wazuh/pull/33383))
- Upgraded Python embedded interpreter to 3.10.19. ([#32790](https://github.com/wazuh/wazuh/pull/32790))

### v5.0.0-beta4 — Wazuh v5.0.0 Beta 4

- Date: 2026-07-21
- Version: v5.0.0-beta4
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta4
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v5.0.0-beta4
- Labels: Pre-release

- **fixed** — Persist engine startup state for CMSync route logging
- **fixed** — Fix invalid MTU value reported for Windows network interfaces
- **fixed** — Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge
- **changed** — Suppress version-coordination WARNINGs on stop/unavailable module
- **changed** — Improve default cores detection
- **fixed** — Handle rootcheck removed tags
- **changed** — Upgrade 5.0.0 python dependencies
- **changed** — Change indexer user name and password
- **removed** — Remove startup deprecation warning from cluster_control and agent_upgrade
- **fixed** — Improve fim_sync db performance
- **changed** — Close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change
- **fixed** — Fix version comparison in indexer documents updates
- **fixed** — Propagate sync errors to each module
- **changed** — Cache indexer credentials in clusterd
- **changed** — Warn on duplicate agent connection only when it persists
- **changed** — Lower DBSync-not-available shutdown messages to DEBUG
- **added** — Add retry logic to indexer templates download
- **changed** — Reduce authd enrollment log severity for expected rejections
- **changed** — Reduce memory usage when downloading VDP feed
- **fixed** — Fix server-side version bump for disconnected agent metadata updates

##### What's Changed
* fix: persist engine startup state for CMSync route logging by @jam300 in https://github.com/wazuh/wazuh/pull/37356
* Fix invalid MTU value reported for Windows network interfaces by @vikman90 in https://github.com/wazuh/wazuh/pull/37394
* Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in https://github.com/wazuh/wazuh/pull/37414
* Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in https://github.com/wazuh/wazuh/pull/37372
* Clarify security policy for pre-release versions and disclosure timeline by @vikman90 in https://github.com/wazuh/wazuh/pull/37423
* Bump 5.0.0 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/37429
* wazuh-manager: Memory and copy-reduction improvements part 1 by @matigarciadev in https://github.com/wazuh/wazuh/pull/36979
* Improve default cores detection by @LucioDonda in https://github.com/wazuh/wazuh/pull/37288
* Standardize and verify Wazuh configuration documentation  by @TomasTurina in https://github.com/wazuh/wazuh/pull/37411
* Handle rootcheck removed tags by @rovogel in https://github.com/wazuh/wazuh/pull/37346
* Update docs (agent) for the new password in manager by @Miguevrgo in https://github.com/wazuh/wazuh/pull/37420
* Backport the workflow for generating pre-release agent issues to version 5.0.0 by @MarcelKemp in https://github.com/wazuh/wazuh/pull/37490
* Upgrade 5.0.0 python dependencies by @jepalfer in https://github.com/wazuh/wazuh/pull/37361
* Change indexer user name and password by @TomasTurina in https://github.com/wazuh/wazuh/pull/37502
* Remove startup deprecation warning from cluster_control and agent_upgrade by @vikman90 in https://github.com/wazuh/wazuh/pull/37509
* Change indexer username and password to wazuh-manager by @TomasTurina in https://github.com/wazuh/wazuh/pull/37520
* Fix to improve fim_sync db performance. by @hernanvalenzuela in https://github.com/wazuh/wazuh/pull/37180
* SCA/FIM sync lifecycle: close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change by @jr0me in https://github.com/wazuh/wazuh/pull/37353
* Fix version comparison in indexer documents updates by @TomasTurina in https://github.com/wazuh/wazuh/pull/37498
* Propagate sync errors to each module by @jpcerrone in https://github.com/wazuh/wazuh/pull/37212
* Cache indexer credentials in clusterd by @TomasTurina in https://github.com/wazuh/wazuh/pull/37504
* Standardize CHANGELOG format and keep prior versions in the bumper by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37513
* Warn on duplicate agent connection only when it persists by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37493
* Backport: Lower DBSync-not-available shutdown messages to DEBUG to 5.0.0 by @anromerom in https://github.com/wazuh/wazuh/pull/37567
* Add retry logic to indexer templates download by @TomasTurina in https://github.com/wazuh/wazuh/pull/37643
* Reduce authd enrollment log severity for expected rejections by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37540
* Reduce memory usage when downloading VDP feed by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/37375
* Fix server-side version bump for disconnected agent metadata updates by @TomasTurina in https://github.com/wazuh/wazuh/pull/37647
* Re-enable AWS Inspector integration tests in 5.0.0 by @MAnDumu in https://github.com/wazuh/wazuh/pull/37645
* Fix sca internal limits by @rovogel in https://github.com/wazuh/wazuh/pull/37438
* Silence untrustworthy FIM schema-validation errors during shutdown by @Nicogp in https://github.com/wazuh/wazuh/pull/37688
* Fix spurious ERROR/WARNING logs during agent shutdown by @Nicogp in https://github.com/wazuh/wazuh/pull/37673
* Fix daemon stats for analysisd by @NahuFigueroa97 in https://github.com/wazuh/wazuh/pull/37525
* Resolve logging macro collisions and improve LogFn design (#37354) by @jotacarma90 in https://github.com/wazuh/wazuh/pull/37393
* Enable authd in mana

_[Truncated at 4000 characters — full notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta4]_

### v4.14.6 — Wazuh v4.14.6

- Date: 2026-07-03
- Version: v4.14.6
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.14.6
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.14.6

- **removed** — Remove unused SSL/TLS transport option from cluster
- **fixed** — Improve message decompression handling in remoted
- **fixed** — Improve agent name validation to reject names starting with dot
- **fixed** — Fix segfault in vulnerability scanner module shutdown when disabled
- **fixed** — Fix string buffer handling in version comparison function
- **fixed** — Improve cluster file synchronization security
- **fixed** — Improve cluster file synchronization error handling on invalid task identifiers
- **fixed** — Improve cluster merged file parameter validation to prevent directory escape
- **fixed** — Improve tmp_file path validation in cluster DAPI
- **fixed** — Improve cluster non-merged file path validation during worker file processing
- **fixed** — Improve cluster node name format validation in the hello handler
- **fixed** — Fix missing agent.host.ip in inventory documents when agent IP is empty
- **fixed** — Fix stale agent synced status after hot reload on cluster worker nodes
- **fixed** — Fix agent registration not running on reinstall after apt-get remove
- **fixed** — Fix MS-Graph integration handling for relationships containing /
- **fixed** — Fix macOS syscollector to skip package receipts whose payload is no longer installed
- **fixed** — Fix missing eBPF create, modify and delete events on Ubuntu 24/26 and improve FIM whodata healthcheck
- **fixed** — Harden FIM database path lookups by migrating to parameterized SQL queries
- **fixed** — Escape control characters in API usernames in access logs
- **fixed** — Add input validation in cluster result handling and authentication
- **fixed** — Fix current user resolution in the update-user endpoint to enforce admin protection

###### Manager

###### Removed

- Removed unused SSL/TLS transport option from cluster. ([#35648](https://github.com/wazuh/wazuh/pull/35648))

###### Fixed

- Improved message decompression handling in remoted. ([#35773](https://github.com/wazuh/wazuh/pull/35773))
- Improved agent name validation to reject names starting with dot. ([#35833](https://github.com/wazuh/wazuh/pull/35833))
- Fixed segfault in vulnerability scanner module shutdown when disabled. ([#36011](https://github.com/wazuh/wazuh/pull/36011))
- Fixed string buffer handling in version comparison function. ([#36059](https://github.com/wazuh/wazuh/pull/36059))
- Improved cluster file synchronization security. ([#36060](https://github.com/wazuh/wazuh/pull/36060))
- Improved cluster file synchronization error handling on invalid task identifiers. ([#36129](https://github.com/wazuh/wazuh/pull/36129))
- Improved cluster merged file parameter validation to prevent directory escape. ([#36204](https://github.com/wazuh/wazuh/pull/36204))
- Improved `tmp_file` path validation in cluster DAPI. ([#36246](https://github.com/wazuh/wazuh/pull/36246))
- Improved cluster non-merged file path validation during worker file processing. ([#36296](https://github.com/wazuh/wazuh/pull/36296))
- Improved cluster node name format validation in the hello handler. ([#36460](https://github.com/wazuh/wazuh/pull/36460))
- Fixed missing `agent.host.ip` in inventory documents when agent IP is empty. ([#35475](https://github.com/wazuh/wazuh/pull/35475))
- Fixed stale agent `synced` status after hot reload on cluster worker nodes. ([#6726](https://github.com/wazuh/external-devel-requests/issues/6726))

###### Agent

###### Fixed

- Fixed agent registration not running on reinstall after `apt-get remove`. ([#35727](https://github.com/wazuh/wazuh/pull/35727))
- Fixed MS-Graph integration handling for relationships containing `/`. ([#35431](https://github.com/wazuh/wazuh/pull/35431))
- Fixed macOS syscollector to skip package receipts whose payload is no longer installed. ([#35380](https://github.com/wazuh/wazuh/pull/35380))
- Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. ([#35838](https://github.com/wazuh/wazuh/pull/35838))
- Hardened FIM database path lookups by migrating to parameterized SQL queries. ([#36399](https://github.com/wazuh/wazuh/pull/36399))

###### RESTful API

###### Fixed

- Escaped control characters in API usernames in access logs. ([#35866](https://github.com/wazuh/wazuh/pull/35866))
- Added input validation in cluster result handling and authentication. ([#35757](https://github.com/wazuh/wazuh/pull/35757))
- Fixed current user resolution in the `update-user` endpoint to enforce admin protection. ([#35442](https://github.com/wazuh/wazuh/pull/35442))

###### Ruleset

###### Fixed

- Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). ([#35927](https://github.com/wazuh/wazuh/pull/35927))

###### Other

###### Changed

- Updated `cryptography`, `urllib3` and `python-multipart` Python dependencies. ([#35982](https://github.com/wazuh/wazuh/pull/35982))
- Updated eBPF libraries: `libbpf` to 1.7.0 and `bpftool` to 7.7.0. ([#36467](https://github.com/wazuh/wazuh/pull/36467))

###### Fixed

- Fixed `wazuh-manager` startup failure on RHEL 10 by dropping the `libcrypt` dependency from embedded Python. ([#36782](https://github.com/wazuh/wazuh/pull/36782))

### v5.0.0-beta3 — Wazuh v5.0.0 Beta 3

- Date: 2026-07-02
- Version: v5.0.0-beta3
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v5.0.0-beta3
- Labels: Pre-release

- **changed** — Improve cluster file synchronization error handling
- **changed** — Update trojan signatures to avoid false positives on modern distros
- **changed** — Improve cluster merged file parameter validation
- **added** — Create a backup of local_rules.xml during execution of IT analysisd tier 0 1
- **changed** — Improve tmp_file path validation in cluster DAPI
- **changed** — Serialize procps access to prevent modulesd crash
- **removed** — Remove obsolete configuration blocks from API upload_configuration setting
- **fixed** — Restore working vulnerability scanner database workflow
- **changed** — Propagate agent merged_sum after hot reload in cluster
- **fixed** — Fix the wazuh-manager-modules crash that occurs while downloading the feed
- **changed** — Migrate FIM DB path queries to parameterized statements
- **fixed** — Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling
- **changed** — Cluster file processing parameter validation
- **fixed** — Treat the absence of the hash document as expected, not an error
- **changed** — geo_point validation support all compatible formats
- **fixed** — Prevent Syscollector and SCA use-after-free on modulesd shutdown
- **changed** — Fixed an issue in eBPF with LSM hooks and improved the health check
- **changed** — Validate cluster node name format
- **changed** — eBPF libraries updated
- **fixed** — Fix policy evaluation errors

##### What's Changed
* Improve cluster file synchronization error handling by @TomasTurina in https://github.com/wazuh/wazuh/pull/36129
* Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in https://github.com/wazuh/wazuh/pull/35927
* Improve cluster merged file parameter validation by @vikman90 in https://github.com/wazuh/wazuh/pull/36204
* Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/36201
* Improve tmp_file path validation in cluster DAPI by @vikman90 in https://github.com/wazuh/wazuh/pull/36246
* Revert bump main branch by @wazuhci in https://github.com/wazuh/wazuh/pull/36303
* Bump 4.14.7 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/36312
* Serialize procps access to prevent modulesd crash by @cborla in https://github.com/wazuh/wazuh/pull/36261
* Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in https://github.com/wazuh/wazuh/pull/36252
* Restore working vulnerability scanner database workflow by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36332
* Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36164
* Merge 4.14.7 into main by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36331
* Authd tier 0-1 flaky tests fix by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36342
* Review agent info logs by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/36234
* Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/36337
* Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/36399
* Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in https://github.com/wazuh/wazuh/pull/36396
* Cluster file processing parameter validation by @vikman90 in https://github.com/wazuh/wazuh/pull/36296
* Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36407
* Treat the absence of the hash document as expected, not an error by @juliancnn in https://github.com/wazuh/wazuh/pull/36355
* geo_point validation support all compatible formats by @LucioDonda in https://github.com/wazuh/wazuh/pull/36034
* Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in https://github.com/wazuh/wazuh/pull/36359
* Add cluster security model and configuration documentation by @vikman90 in https://github.com/wazuh/wazuh/pull/36405
* Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in https://github.com/wazuh/wazuh/pull/36446
* Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in https://github.com/wazuh/wazuh/pull/35838
* Validate cluster node name format by @vikman90 in https://github.com/wazuh/wazuh/pull/36460
* eBPF libraries updated by @MarcelKemp in https://github.com/wazuh/wazuh/pull/36467
* Bump 4.14.6 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/36517
* Revert "Bump 4.14.6 branch" by @MARCOSD4 in https://github.com/wazuh/wazuh/pull/36518
* Bump 4.14.6 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/36519
* Update changelog for 4.14.6 RC 1 by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36562
* Fix policy evaluation errors by @fcontrerasc in https://github.com/wazuh/wazuh/pull/36449
* Release startup hash gate when the reload chain fails by @jr0me in https://github.com/wazuh/wazuh/pull/36302
* Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in https://github.com/wazuh/wazuh/pull/36591
* Merge merge-4.14.7-into-main into main [automated] by @wazuhci in https://github.com/wazuh/wazuh/pull/36624
* Restore event counter and classify received messages by @jotacarma90 in https://github.com/wazuh/wazuh/pull/36456
* Unify manager int

_[Truncated at 4000 characters — full notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3]_

### v5.0.0-beta2 — Wazuh v5.0.0 Beta 2

- Date: 2026-05-21
- Version: v5.0.0-beta2
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v5.0.0-beta2
- Labels: Pre-release

- **fixed** — Dovecot decoders do not match correctly
- **fixed** — CIS 35675 and 35689 rules bug
- **changed** — Improve buffer handling in regex match processing
- **fixed** — Empty-message failure in Windows enrollment integration test
- **changed** — Use daily marker for GuardDuty log collector
- **fixed** — Rate limit handling for /events endpoint
- **changed** — Upload size limit config mismatch implementation
- **changed** — Update embedded Python and dependencies
- **fixed** — Escape document id in delete bulk operations
- **added** — Add length validation after decompression in ReadSecMSG
- **fixed** — Uncontrolled memory allocation in cluster
- **added** — Limit nested JSON depth in API requests
- **fixed** — Clang-format version resolution in CI
- **fixed** — Align plugin decoder arguments with existing call path
- **added** — Add groups path validation
- **fixed** — Audit log cache overflow for events with many records
- **changed** — Update dependencies: cryptography, requests
- **fixed** — Memory allocation for long registry paths in syscheck
- **fixed** — Rootcheck not generating findings
- **fixed** — Active config endpoint and integration tests
- **fixed** — Coverity findings in group validation paths

##### What's Changed
* Coding style clang format by @jotacarma90 in https://github.com/wazuh/wazuh/pull/35051
* Dovecot decoders don't match correctly by @hossam1522 in https://github.com/wazuh/wazuh/pull/35089
* Fixing CIS 35675 and 35689 rules bug by @hossam1522 in https://github.com/wazuh/wazuh/pull/35088
* Improve buffer handling in regex match processing by @vikman90 in https://github.com/wazuh/wazuh/pull/35106
* Fix empty-message failure in Windows enrollment integration test by @hernanvalenzuela in https://github.com/wazuh/wazuh/pull/35078
* Use daily marker for GuardDuty log collector by @anromerom in https://github.com/wazuh/wazuh/pull/35110
* Fix rate limit handling for /events endpoint by @javiersanchz in https://github.com/wazuh/wazuh/pull/35077
* Upload Size Limit Config Mismatch - Implementation by @jnasselle in https://github.com/wazuh/wazuh/pull/35141
* Update embedded Python and dependencies by @javiersanchz in https://github.com/wazuh/wazuh/pull/35135
* Escape document id in delete bulk operations by @ignaciogalle12git in https://github.com/wazuh/wazuh/pull/35174
* Add length validation after decompression in ReadSecMSG by @MiguelazoDS in https://github.com/wazuh/wazuh/pull/35193
* Fix uncontroller memory allocation in cluster by @FrancoRivero2025 in https://github.com/wazuh/wazuh/pull/35173
* Limit nested JSON depth in API requests - Implementation by @jnasselle in https://github.com/wazuh/wazuh/pull/35224
* Fix clang-format version resolution in CI by @jotacarma90 in https://github.com/wazuh/wazuh/pull/35180
* Align plugin decoder arguments with existing call path by @matigarciadev in https://github.com/wazuh/wazuh/pull/35176
* Add groups path validation by @TomasTurina in https://github.com/wazuh/wazuh/pull/35230
* Fix audit log cache overflow for events with many records by @vikman90 in https://github.com/wazuh/wazuh/pull/35285
* Update dependencies: cryptography, requests by @javiersanchz in https://github.com/wazuh/wazuh/pull/35331
* Fix memory allocation for long registry paths in syscheck by @Darioortegaleyva in https://github.com/wazuh/wazuh/pull/35287
* Fix for rootcheck not generating findings by @jpcerrone in https://github.com/wazuh/wazuh/pull/35297
* Bump 4.14.6 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/35379
* Fix coverity findings in group validation paths by @TomasTurina in https://github.com/wazuh/wazuh/pull/35384
* Fix active config endpoint and Integration tests by @FrancoRivero2025 in https://github.com/wazuh/wazuh/pull/35412
* Server integration tests flaky test by @Antoniogm03 in https://github.com/wazuh/wazuh/pull/35353
* Skip macOS receipts that are no longer installed by @anromerom in https://github.com/wazuh/wazuh/pull/35380
* Revert tag references to main after v5.0.0-beta1 by @jotacarma90 in https://github.com/wazuh/wazuh/pull/35447
* Improve the code to hide information when a user doesn't have permission by @FrancoRivero2025 in https://github.com/wazuh/wazuh/pull/35307
* Validate current user in update-user endpoint by @vikman90 in https://github.com/wazuh/wazuh/pull/35442
* Complete wazuh server requirements docs by @TomasTurina in https://github.com/wazuh/wazuh/pull/35459
* Optimize error handling geoip locator by @LucioDonda in https://github.com/wazuh/wazuh/pull/35187
* wazuh-engine: `/logtest` endpoint cleanup temporary fields by @matigarciadev in https://github.com/wazuh/wazuh/pull/35420
* Add fast metrics module by @NahuFigueroa97 in https://github.com/wazuh/wazuh/pull/35142
* Bump 4.14.5 branch by @wazuhci in https://github.com/wazuh/wazuh/pull/35465
* Update changelog for v4.14.5-rc1 by @jotacarma90 in https://github.com/wazuh/wazuh/pull/35467
* Fix guardduty.py size in check files by @MarcelKemp in https://github.com/wazuh/wazuh/pull/35472
* Update uninstall procedure for Windows. by @rjcausarano in https://github.com/wazuh/wazuh/pull/35451
* Ms-graph - handle relationships that contain '/' by @jpcerrone in https://github.com/wazuh/wazuh/pull/35431
* Va

_[Truncated at 4000 characters — full notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2]_

### v4.14.5 — Wazuh v4.14.5

- Date: 2026-04-23
- Version: v4.14.5
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.14.5
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.14.5

- **fixed** — Fixed DAPI callable resolution to restrict invocations to exposed resources only
- **security** — Fixed uncontrolled memory allocation in cluster caused by crafted packet length
- **security** — Fixed rate limit bypass for the /events endpoint
- **security** — Fixed buffer overflow in analysisd regex match processing
- **security** — Fixed path traversal in authd via agent group name validation
- **security** — Fixed size_t underflow in remoted ReadSecMSG causing potential heap overflow
- **security** — Fixed RBAC bypass in DAPI allowing privilege escalation
- **fixed** — Fixed analysisd plugin decoder argument alignment
- **fixed** — Fixed rootcheck false positive for /dev/.blkid.tab
- **fixed** — Fixed ORDER_REVERSAL deadlocks in FIM
- **fixed** — Fixed Roundcube decoder regex to prevent srcip truncation in Failed login logs
- **fixed** — Fixed macOS Ventura SCA policy incorrectly passing pmset checks
- **fixed** — Fixed Office365 integration pagination by trimming HTTP header values
- **fixed** — Fixed FIM false positives caused by double readdir check
- **fixed** — Fixed audit log cache overflow for events with many records in logcollector
- **fixed** — Fixed daily marker for GuardDuty log collector
- **fixed** — Fixed rootcheck not generating findings
- **security** — Fixed heap buffer overflow in syscheck Registry Wildcard Expansion
- **changed** — Changed RHEL init script with SUSE variant on SLES 11
- **changed** — Changed service check from WMI to sc.exe

##### Manager

###### Fixed

- Fixed DAPI callable resolution to restrict invocations to exposed resources only. ([#34889](https://github.com/wazuh/wazuh/pull/34889))
- Fixed uncontrolled memory allocation in cluster caused by crafted packet length. ([#35173](https://github.com/wazuh/wazuh/pull/35173)) ([#35412](https://github.com/wazuh/wazuh/pull/35412))
- Fixed rate limit bypass for the `/events` endpoint. ([#35077](https://github.com/wazuh/wazuh/pull/35077))
- Fixed buffer overflow in analysisd regex match processing. ([#35106](https://github.com/wazuh/wazuh/pull/35106))
- Fixed path traversal in authd via agent group name validation. ([#35230](https://github.com/wazuh/wazuh/pull/35230))
- Fixed size_t underflow in remoted ReadSecMSG causing potential heap overflow. ([#35193](https://github.com/wazuh/wazuh/pull/35193))
- Fixed RBAC bypass in DAPI allowing privilege escalation. ([#35307](https://github.com/wazuh/wazuh/pull/35307))
- Fixed analysisd plugin decoder argument alignment. ([#35176](https://github.com/wazuh/wazuh/pull/35176))

##### Agent

###### Fixed

- Fixed rootcheck false positive for /dev/.blkid.tab. ([#34734](https://github.com/wazuh/wazuh/pull/34734))
- Fixed ORDER_REVERSAL deadlocks in FIM. ([#34735](https://github.com/wazuh/wazuh/pull/34735))
- Fixed Roundcube decoder regex to prevent srcip truncation in "Failed login ... in session" logs. ([#34793](https://github.com/wazuh/wazuh/pull/34793))
- Fixed macOS Ventura SCA policy incorrectly passing pmset checks. ([#34693](https://github.com/wazuh/wazuh/pull/34693))
- Fixed Office365 integration pagination by trimming HTTP header values. ([#34673](https://github.com/wazuh/wazuh/pull/34673))
- Fixed FIM false positives caused by double readdir check. ([#34880](https://github.com/wazuh/wazuh/pull/34880))
- Fixed audit log cache overflow for events with many records in logcollector. ([#35285](https://github.com/wazuh/wazuh/pull/35285))
- Fixed daily marker for GuardDuty log collector. ([#35110](https://github.com/wazuh/wazuh/pull/35110))
- Fixed rootcheck not generating findings. ([#35297](https://github.com/wazuh/wazuh/pull/35297))
- Fixed heap buffer overflow in syscheck Registry Wildcard Expansion. ([#35287](https://github.com/wazuh/wazuh/pull/35287))

###### Changed

- Changed RHEL init script with SUSE variant on SLES 11. ([#34563](https://github.com/wazuh/wazuh/pull/34563))
- Changed service check from WMI to sc.exe. ([#34543](https://github.com/wazuh/wazuh/pull/34543))
- Changed windows syscollector to include command arguments. ([#34727](https://github.com/wazuh/wazuh/pull/34727))

##### RESTful API

###### Fixed

- Fixed `allow_higher_versions` validation in API `upload_configuration`. ([#34905](https://github.com/wazuh/wazuh/pull/34905))
- Fixed nested JSON depth limit in API request processing. ([#35224](https://github.com/wazuh/wazuh/pull/35224))
- Fixed upload size limit config mismatch. ([#35141](https://github.com/wazuh/wazuh/pull/35141))

##### Ruleset

###### Fixed

- Fixed bug in CIS SCA checks 35675 and 35689 for Ubuntu 24.04. ([#35088](https://github.com/wazuh/wazuh/pull/35088))
- Fixed Dovecot decoders to correctly extract `rip` and `lip` fields. ([#35089](https://github.com/wazuh/wazuh/pull/35089))

##### Other

###### Changed

- Updated dependencies `cryptography` to 46.0.5, `Werkzeug` to 3.1.6, `pip` to 26.0.1 and `wheel` to 0.46.3. ([#34907](https://github.com/wazuh/wazuh/pull/34907))
- Updated embedded Python to 3.10.20 and dependencies pyjwt, pyasn1. ([#35135](https://github.com/wazuh/wazuh/pull/35135))
- Updated dependencies cryptography, requests. ([#35331](https://github.com/wazuh/wazuh/pull/35331))

### v5.0.0-beta1 — Wazuh v5.0.0-beta1

- Date: 2026-04-15
- Version: v5.0.0-beta1
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta1
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v5.0.0-beta1
- Labels: Pre-release

- **added** — Add cluster-by-default deployment model where all Wazuh Server installations run as a cluster node, removing the distinction between clustered and non-clustered deployments
- **added** — Add stateless metadata enrichment in remoted, centralizing event metadata handling for stateless messages and removing the dependency on wazuh-db for that ingestion path
- **added** — Add Engine enrichment support for IOC matching, GeoIP lookup, and event filters
- **added** — Add Engine adaptation tier 2 with raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure
- **added** — Add Wazuh Instance Registration status to reflect CTI access_token availability with states Pending, Polling, Denied, and Available
- **added** — Add local state persistence for agent modules including FIM, System Inventory, and SCA, removing the dependency on rsync with the Wazuh Server
- **changed** — Upgrade embedded Python interpreter from 3.10 to 3.12
- **changed** — Adapt Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm covering first-scan, inventory-change, and feed-update scenarios
- **changed** — Revamp Role-Based Access Control management and introduce an upgrade mechanism for existing RBAC configurations
- **changed** — Change the Wazuh Manager installation path to /var/wazuh-manager replacing /var/ossec and remove agent ID 000, fully decoupling agent and manager processes on shared hosts
- **changed** — Change Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector
- **changed** — Adjust agent-side Vulnerability Detector inventory emission and synchronization for OS, packages, and hotfixes to align with updated VD behavior in Wazuh 5.0
- **changed** — Simplify rootcheck by removing the server-side database, sync path, and API surface with findings now indexed through the standard alert pipeline
- **changed** — Update logcollector file-tailing initial read strategy for more consistent behavior across log rotation scenarios
- **changed** — Update Windows Event Channel log collection to emit native XML from EvtRender() without an XML declaration header
- **changed** — Increase default limits for agent event throughput and inventory message sizes
- **removed** — Remove Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via indexer-connector
- **removed** — Remove deprecated manager daemons: ossec-authd, wazuh-agentlessd, wazuh-maild, wazuh-dbd
- **removed** — Remove deprecated C CLI tools: manage_agents and agent-auth
- **removed** — Remove OpenSCAP server-side module

##### Manager

###### Added

- Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The `cluster.disabled` configuration option has been removed. ([#31295](https://github.com/wazuh/wazuh/issues/31295))
- Added stateless metadata enrichment in `remoted`, centralizing event metadata handling for stateless messages and removing the dependency on `wazuh-db` for that ingestion path. ([#33269](https://github.com/wazuh/wazuh/issues/33269))
- Added Engine enrichment support: IOC matching, GeoIP lookup, and event filters. ([#33493](https://github.com/wazuh/wazuh/issues/33493))
- Added Engine adaptation tier 2: raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure. ([#34477](https://github.com/wazuh/wazuh/issues/34477))
- Added Wazuh Instance Registration status to reflect CTI `access_token` availability (`Pending`, `Polling`, `Denied`, `Available`), allowing the Dashboard to query the subscription state. ([#31906](https://github.com/wazuh/wazuh/pull/31906))

###### Changed

- Upgraded embedded Python interpreter from 3.10 to 3.12. ([#33377](https://github.com/wazuh/wazuh/issues/33377)) ([#33570](https://github.com/wazuh/wazuh/issues/33570))
- Adapted Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm, covering first-scan, inventory-change, and feed-update scenarios. ([#30535](https://github.com/wazuh/wazuh/issues/30535))
- Revamped Role-Based Access Control (RBAC) management and introduced an upgrade mechanism for existing RBAC configurations. ([#27706](https://github.com/wazuh/wazuh/issues/27706))
- Removed legacy configuration surfaces, database schemas, build targets, and compatibility layers in the second server cleanup phase. ([#34608](https://github.com/wazuh/wazuh/issues/34608))

###### Removed

- Removed Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via `indexer-connector`. ([#33124](https://github.com/wazuh/wazuh/pull/33124))
- Removed deprecated manager daemons: `ossec-authd`, `wazuh-agentlessd`, `wazuh-maild`, `wazuh-dbd`. ([#30922](https://github.com/wazuh/wazuh/issues/30922))
- Removed deprecated C CLI tools: `manage_agents`, `agent-auth`. ([#30924](https://github.com/wazuh/wazuh/issues/30924))
- Removed OpenSCAP server-side module. ([#31028](https://github.com/wazuh/wazuh/issues/31028))
- Removed inventory-related API endpoints. ([#31299](https://github.com/wazuh/wazuh/issues/31299))
- Removed legacy API security configuration endpoints. ([#28425](https://github.com/wazuh/wazuh/issues/28425))

###### Fixed

- Fixed Vulnerability Detector version matcher logic for improved detection accuracy. ([#31746](https://github.com/wazuh/wazuh/issues/31746))
- Fixed Cloudtrail log ingestion parsing errors. ([#33108](https://github.com/wazuh/wazuh/issues/33108))

##### Agent

###### Added

- Added local state persistence for agent modules (FIM, System Inventory, SCA), removing the dependency on `rsync` with the Wazuh Server and reducing network traffic and server-side processing overhead. ([#29533](https://github.com/wazuh/wazuh/issues/29533)) ([#31838](https://github.com/wazuh/wazuh/issues/31838))

###### Changed

- Changed the Wazuh Manager installation path to `/var/wazuh-manager` (replacing `/var/ossec`) and removed agent ID `000`, fully decoupling agent and manager processes on shared hosts. ([#33378](https://github.com/wazuh/wazuh/issues/33378))
- Changed Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector. ([#34849](https://github.com/wazuh/wazuh/issues/34849))
- Adjusted agent-side Vulnerability Detector inventory emission and synchronization (OS, packages, hotfixes) to align with the updated V

_[Truncated at 4000 characters — full notes: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta1]_

### v4.14.4 — Wazuh v4.14.4

- Date: 2026-03-17
- Version: v4.14.4
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.14.4
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.14.4

- **fixed** — Fixed heap-based null WRITE buffer underflows in the Manager
- **fixed** — Fixed MS Graph default rules not triggering properly
- **fixed** — Unified date formats in Active Response logs to ensure consistent timestamp formatting
- **changed** — Updated Docker integration rules to improve detection coverage and compatibility
- **fixed** — Fixed heap-based NULL write buffer underflow in GetAlertData
- **fixed** — Retained MSI installer log after Windows agent upgrade to improve troubleshooting visibility
- **fixed** — Fixed incorrect Windows 11 edition detection after upgrading the agent to version 4.14.3
- **fixed** — Fixed macOS agent crash during syscollector reload caused by invalid pthread_cond_destroy() usage
- **fixed** — Fixed Windows OS edition detection
- **fixed** — Fixed pthread_mutex_destroy invalid argument error on AIX in syscollector
- **changed** — Changed msi_output extension from txt to log
- **changed** — Changed to unsigned char in print_hex_string
- **changed** — Changed sync primitive disposal to stop and soften teardown failures
- **fixed** — Fixed timestamps in the /agents/upgrade_result endpoint to return accurate UTC time
- **fixed** — Improved cluster file synchronization path handling by adding safe path joins
- **fixed** — Fixed API login race condition
- **changed** — Updated the azure-core dependency to 1.38.0 and the Werkzeug dependency to 3.1.5
- **changed** — Updated the protobuf dependency to 5.29.6 and the python-multipart dependency to 0.0.22

##### Manager

###### Fixed

- Fixed heap-based null WRITE Buffer Underflows. ([34658](https://github.com/wazuh/wazuh/pull/34658))

##### Agent

###### Fixed

- Fixed MS Graph default rules not triggering properly. ([#34240](https://github.com/wazuh/wazuh/pull/34240))
- Unified date formats in Active Response logs to ensure consistent timestamp formatting. ([#34473](https://github.com/wazuh/wazuh/pull/34473))
- Updated Docker integration rules to improve detection coverage and compatibility. ([#34376](https://github.com/wazuh/wazuh/pull/34376))
- Fixed heap-based NULL write buffer underflow in `GetAlertData`. ([#34501](https://github.com/wazuh/wazuh/pull/34501))
- Retained MSI installer log after Windows agent upgrade to improve troubleshooting visibility. ([#34517](https://github.com/wazuh/wazuh/pull/34517))
- Fixed incorrect Windows 11 edition detection after upgrading the agent to version 4.14.3. ([#34530](https://github.com/wazuh/wazuh/pull/34530))
- Fixed macOS agent crash during syscollector reload caused by invalid `pthread_cond_destroy()` usage. ([#34274](https://github.com/wazuh/wazuh/pull/34274))
- Fixed Windows OS edition detection. ([34540](https://github.com/wazuh/wazuh/pull/34540))
- Fix pthread_mutex_destroy invalid argument error on AIX in syscollector. ([#34900](https://github.com/wazuh/wazuh/pull/34900))

###### Changed

- Changed msi_output extension from txt to log. ([34541](https://github.com/wazuh/wazuh/pull/34541))
- Changed to unsigned char in print_hex_string. ([34602](https://github.com/wazuh/wazuh/pull/34602))
- Changed sync primitive disposal to stop and soften teardown failures. ([34552](https://github.com/wazuh/wazuh/pull/34552))

##### RESTful API

###### Fixed

- Fixed timestamps in the `/agents/upgrade_result` endpoint to return accurate UTC time. ([#34176](https://github.com/wazuh/wazuh/pull/34176))
- Improved cluster file synchronization path handling by adding safe path joins. ([#34464](https://github.com/wazuh/wazuh/pull/34464))
- Fixed API login race condition- ([34459](https://github.com/wazuh/wazuh/pull/34459))

##### Other

###### Changed

- Updated the `azure-core` dependency to 1.38.0 and the `Werkzeug` dependency to 3.1.5. ([#34154](https://github.com/wazuh/wazuh/pull/34154))
- Updated the `protobuf` dependency to 5.29.6 and the `python-multipart` dependency to 0.0.22. ([#34403](https://github.com/wazuh/wazuh/pull/34403))

### v4.14.3 — Wazuh v4.14.3

- Date: 2026-02-11
- Version: v4.14.3
- Original notes: https://github.com/wazuh/wazuh/releases/tag/v4.14.3
- Permalink: https://whatsnew.fyi/product/wazuh/releases/v4.14.3

- **fixed** — Escape document ID when necessary before sending document to indexer
- **fixed** — Extend timestamp conversion helpers to support additional input formats and normalize ISO8601 strings
- **security** — Restrict cluster file transfer write paths
- **security** — Harden cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling
- **security** — Add query size checks for syscollector delta sync SQL generation to prevent buffer overflows
- **security** — Replace unsafe sprintf calls in the SCA decoder to prevent buffer overflows
- **fixed** — Fix memory leak in the CIS-CAT decoder when database operations fail
- **fixed** — Fix ruleset hot reload on workers by awaiting send_reload_ruleset_msg
- **added** — Add hostname and architecture metadata to Windows keep-alive messages
- **fixed** — Fix UTF-16 casting when updating report_changes
- **fixed** — Improve Active Response key handling in wazuh-execd
- **security** — Add bounds checking to Logcollector max-size configuration serialization
- **security** — Harden Logcollector multiline backup handling to use full-buffer copies
- **fixed** — Fix label formatting edge cases in keep-alive notify messages
- **fixed** — Fix false positive in vulnerability detection for Oracle Linux 8
- **security** — Extend Windows network path restrictions to block extended-length UNC paths
- **fixed** — Fix crash in network path detection on Windows
- **fixed** — Fix Agent reload failure on Linux systems with systemd version 219 or lower
- **changed** — Improve authentication performance by caching generated keypairs and clearing the cache when key files change
- **fixed** — Improve configuration upload validation by parsing and comparing Wazuh XML configurations more reliably
- **fixed** — Fix protected settings checks when multiple ossec_config blocks are present
- **added** — Add CIS SCA policy for macOS 26 Tahoe
- **fixed** — Fix SCA policy execution on Windows Server 2019 by using the correct PowerShell path

##### Manager

###### Fixed

- Scaped document ID when necessary before sending document to indexer. ([#33464](https://github.com/wazuh/wazuh/pull/33464))
- Extended timestamp conversion helpers to support additional input formats and normalize ISO8601 strings. ([#33551](https://github.com/wazuh/wazuh/pull/33551))
- Restricted cluster file transfer write paths. ([#33705](https://github.com/wazuh/wazuh/pull/33705))
- Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. ([#33910](https://github.com/wazuh/wazuh/pull/33910))
- Added query size checks for syscollector delta sync SQL generation to prevent buffer overflows. ([#33803](https://github.com/wazuh/wazuh/pull/33803))
- Replaced unsafe `sprintf` calls in the SCA decoder to prevent buffer overflows. ([#33756](https://github.com/wazuh/wazuh/pull/33756))
- Fixed a memory leak in the CIS-CAT decoder when database operations fail. ([#33739](https://github.com/wazuh/wazuh/pull/33739))
- Fixed ruleset hot reload on workers by awaiting `send_reload_ruleset_msg`. ([#34184](https://github.com/wazuh/wazuh/pull/34184))

##### Agent

###### Added

- Added hostname and architecture metadata to Windows keep-alive messages. ([#33831](https://github.com/wazuh/wazuh/pull/33831))

###### Fixed

- Fixed UTF-16 casting when updating `report_changes`. ([#33495](https://github.com/wazuh/wazuh/pull/33495))
- Improved Active Response key handling in wazuh-execd. ([#33665](https://github.com/wazuh/wazuh/pull/33665))
- Added bounds checking to Logcollector `max-size` configuration serialization. ([#33704](https://github.com/wazuh/wazuh/pull/33704))
- Hardened Logcollector multiline backup handling to use full-buffer copies. ([#33926](https://github.com/wazuh/wazuh/pull/33926))
- Fixed label formatting edge cases in keep-alive notify messages. ([#33708](https://github.com/wazuh/wazuh/pull/33708))
- Fixed a false positive in vulnerability detection for Oracle Linux 8. ([#33583](https://github.com/wazuh/wazuh/pull/33583))
- Extended Windows network path restrictions to block extended-length UNC paths. ([#34115](https://github.com/wazuh/wazuh/pull/34115))
- Fixed crash in network path detection on Windows. ([#34162](https://github.com/wazuh/wazuh/pull/34162))
- Fixed Agent reload failure on Linux systems with systemd version 219 or lower. ([#34064](https://github.com/wazuh/wazuh/pull/34064))

##### RESTful API

###### Changed

- Improved authentication performance by caching generated keypairs and clearing the cache when key files change. ([#33702](https://github.com/wazuh/wazuh/pull/33702))

###### Fixed

- Improved configuration upload validation by parsing and comparing Wazuh XML configurations more reliably. ([#33683](https://github.com/wazuh/wazuh/pull/33683))
- Fixed protected settings checks when multiple `<ossec_config>` blocks are present. ([#33807](https://github.com/wazuh/wazuh/pull/33807))

##### Ruleset

###### Added

- Added a CIS SCA policy for macOS 26 Tahoe. ([#33492](https://github.com/wazuh/wazuh/pull/33492))

###### Fixed

- Fixed SCA policy execution on Windows Server 2019 by using the correct PowerShell path. ([#34141](https://github.com/wazuh/wazuh/pull/34141))

##### Other

###### Changed

- Updated the `werkzeug` dependency to 3.1.4. ([#33569](https://github.com/wazuh/wazuh/pull/33569))
- Updated the `urllib3` dependency to 2.6.3. ([#33927](https://github.com/wazuh/wazuh/pull/33927))