GitHub Release: wazuh/wazuh v4.14.11-rc1 (11.11.2026)

What's Changed

• Bump 4.14.11 branch by @wazuhci in #40319


• Merge 4.14.10 into 4.14.11 by @TomasTurina in #40394


• Validate group_id before building group file paths by @Antoniogm03 in #40363


• Validate the request counter before the agent answers a manager request by @anromerom in #40467


• Reject group_id resolving outside the shared directory by @jepalfer in #40421


• Return agents without a known OS as failed items in GET /agents/summary/os by @Antoniogm03 in #40403


• Harden cluster error_receiving_file input handling by @jepalfer in #40367


• Use defusedxml to parse XML in dev tooling by @jepalfer in #40425


• Reject excluded files pushed by the master in the cluster worker by @Antoniogm03 in #40366


• Fix random agent-auth enrollment failures caused by an uninitialized receive timeout by @MAnDumu in #40468


• Close the execd local request client on every receive outcome by @Nicogp in #40529


• Close the logcollector local request client on every receive outcome by @Nicogp in #40537


• Report agents deleted or disconnected during an upgrade as failed items by @jepalfer in #40427


• Vuln scanner maps kernel variant by @jepalfer in #40486


• Close the client when a request has no newline terminator by @jepalfer in #40391


• Return the master installation uid on worker nodes in node info by @jepalfer in #40464


• macOS 27 Golden Gate codename mapped to Darwin 27 by @hernanvalenzuela in #40539


• Fix snort decoder truncating srcip and keeping the port in dstip by @AwwalQuan in #40521


• Fix proftpd-login failed decoder regex never matching by @AwwalQuan in #40520


• Forget repeated offenders after their block ends and cap how many wazuh-execd tracks by @nbertoldo in #40540


• Show what each azure-logs source collects in the active configuration and stop leaking it on every read by @nbertoldo in #40579


• Use the OS release in the Windows 10 CPE when the agent reports no display version by @ignaciogalle12git in #40489


• Fix Azure Log Analytics missing records ingested late by @MAnDumu in #40538


• Fix FIM diff limit parsing, whodata event loss and fd/FILE handling by @Darioortegaleyva in #39812


• Dump the ms-graph resource names and all relationships in the module configuration by @hernanvalenzuela in #40580


• Decode usermod group changes and mariadbd/mysql syslog access-denied lines by @AwwalQuan in #40640


• Report whodata paths under symbolic links as FIM stores them by @Miguevrgo in #40361


• Merge 4.14.10 into 4.14.11 by @TomasTurina in #40701


• Stop wazuh-syscheckd from crashing when it is stopped during a FIM scan by @hernanvalenzuela in #40692


• Harden agent Unix domain socket creation by @Darioortegaleyva in #39870


• Harden Unix domain socket creation in the shared socket wrapper by @Darioortegaleyva in #40481


• Reject invalid router provider endpoint names in wazuh-modulesd by @Darioortegaleyva in #40592


• Harden the macOS agent package against planted symlinks and hard links in etc/ on upgrade by @jr0me in #40696


• Ignore the dist tag minor of CentOS Stream packages when matching fixed versions by @Antoniogm03 in #40566


• Fix Azure Storage skipping blobs of containers that share a storage account by @MAnDumu in #40646


• fix(pagerduty): send error and critical severities for high-level alerts by @MiguelazoDS in #40654


• Resolve Coverity findings of the manager for 4.14.10 RC 1 by @Antoniogm03 in #40667


• Make DEB package removal tolerate an incomplete installation by @Antoniogm03 in #40500


• Fix the AWS module stopping when the assumed role session expires by @MAnDumu in #40821


• Apply the API remote_commands restriction to syscheck prefilter_cmd in the configuration upload by @Antoniogm03 in #40791


• Run the rootcheck hidden-port check on Linux hosts without netstat by using ss by @cborla in #40815


• Validate the PID identity before killing a stale pidfile owner by @jotacarma90 in #40908


• Move wazuh-agentd and wazuh-logcollector shutdown out of the signal handler by @lchico in #40816


• Wazuh server API: GET /rules cost grows quadratically with the number of rule files by @matigarciadev in #40841


• Validate the uploaded configuration as the daemons read it by @Antoniogm03 in #40720


• fix(authd): read the oversized group name before freeing its buffer by @MiguelazoDS in #40811


• Report the IPv6 gateway on the Syscollector ipv6 protocol row by @hernanvalenzuela in #40847


• Fix the AWS S3 buckets not reading new logs after an object whose key sorts after them by @MAnDumu in #40848


• Report labelled IPv4 addresses under the interface that holds them and keep the Linux network scan running by @nbertoldo in #40916


• Keep logcollector from dropping a snort-full alert cut by the end of a read by @jr0me in #40865


• Monitor active-responses.log by default in the macOS agent package by @Darioortegaleyva in #40799


• Build cpp-httplib with poll to serve descriptors above 1024 by @Antoniogm03 in #40785


• Apply a changed config profile to agent.conf on the first agent restart by @Nicogp in #40930


• Keep logcollector from dropping a later line after an oversized line by @Darioortegaleyva in #40826


• Fix analysisd crash when reloading the ruleset under load by @vikman90 in #40907


• Windows agent no longer deletes shared group files with non-ASCII names by @hernanvalenzuela in #40935


• Rootcheck: Optimize PID search and check up to pid_max ids by @jpcerrone in #40913


• Fix the AWS SQS subscribers stopping at a message they cannot process by @MAnDumu in #40937


• Remove spaces from Windows Eventchannel EventData field names by @Antoniogm03 in #40518


• fix(utils): report the errno reason when a decompression write fails by @MiguelazoDS in #40976


• Logcollector: keep multi-line events aligned when a read reaches max_lines or drops a NUL line by @jpcerrone in #40974


• Close the local request client on every receive outcome in the remaining daemons by @MiguelazoDS in #41011


• Monitor registry keys created after startup that match a FIM wildcard by @hernanvalenzuela in #40978


• Let a stop request interrupt a running syscollector scan on the Windows agent by @lchico in #41029


• Migrate the 4.x macOS test workflows to the macos-15 runner image by @jpcerrone in #41019


• Report FIM eBPF whodata events after the operation completes and send only their used part by @Miguevrgo in #40662


• Keep reading newer journald entries after one that cannot be formatted by @cborla in #41068


• Apply the AWS module discard filter only when discard_regex is configured by @cborla in #41071


• Give configured labels precedence over log fields in json localfiles by @cborla in #41072


• Fix the AWS module taking quadratic time to parse JSON events and reading S3 objects of any size by @MAnDumu in #41059


• Report DHCP on the Syscollector protocol rows from the running network state on Linux and macOS by @anromerom in #40959


• Skip freeing libbpf handle when it failed to load by @Miguevrgo in #41098


• Accept the command name in PUT /active-response by @Antoniogm03 in #40660


• fix(api): log the real event count of POST /events batches the access logger does not buffer by @Antoniogm03 in #41161


• Require every key of a dictionary run_as rule to be satisfied by @ignaciogalle12git in #41162


• Release the previous static field value when sibling decoders set it again by @matigarciadev in #41080


• Merge 4.14.10 into 4.14.11 by @TomasTurina in #41189


• Reject shared group files with NUL bytes and no line feed in remoted by @Antoniogm03 in #41198


• Resolve Coverity findings of the agent for 4.14.10 RC 1 by @Miguevrgo in #40875


• Fix the GCP Pub/Sub integration getting stuck at a message too large to send by @MAnDumu in #41170


• fix: Implemented correction for race condition in OSList getter methods by @matigarciadev in #41215


• Resume journald reading from the last read entry after a rotation by @Miguevrgo in #40825


• Stop wodle commands hanging in wazuh-modulesd when another module starts a process at the same time by @Darioortegaleyva in #41158


• chore(templates): add the 4.x Ruleset release testing issue template by @AwwalQuan in #40898


• Keep logcollector from dropping a line after an oversized line on Windows by @Darioortegaleyva in #41202


• Validate FIM eBPF syscall events and fix the reported device by @Miguevrgo in #40510


• Run the FIM eBPF tests on distribution systems in CI by @Miguevrgo in #40585


• Retry and log failed firewall commands in Unix active responses by @Darioortegaleyva in #41111


• Harden the file open used by the logcollector binary-content check by @Darioortegaleyva in #40664


• Harden how the agent creates PID files and the Auditd plugin socket by @Darioortegaleyva in #41045


• Validate active response source IPs with the manager's strict grammar by @Darioortegaleyva in #41164


• fix(vulnerability-scanner): scan connected agents before checking node_name on cluster re-scan by @MiguelazoDS in #41196


• Resolve the configuration update permission in white RBAC mode when masking the configuration by @Antoniogm03 in #41208


• fix(remoted): ignore a close for a TCP connection that is already closed by @MiguelazoDS in #41229


• Bump 4.14.11 branch by @wazuhci in #41292

Full Changelog: v4.14.10...v4.14.11-rc1