CVE-2026-76821 in OpenCTI
Summary
by MITRE • 09/15/2026
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in opencti-platform/opencti-graphql/src/parser/json-mapper.ts without validating its complexity. An authenticated user with JSON mapper creation permission could provide a catastrophically backtracking pattern and matching ingestion input, blocking the Node.js event loop and making the GraphQL API unavailable to all users. Scheduled ingestion could repeatedly execute the malicious mapper without additional attacker action, and recovery could require disabling the mapper and restarting the process. The issue affects availability and does not expose or modify data. This issue is fixed in version 7.260706.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
OpenCTI serves as a critical open-source platform for managing cyber threat intelligence knowledge and observables, facilitating the aggregation and analysis of security data across organizations. Within this ecosystem, the JSON ingestion mapper plays a pivotal role in parsing incoming data streams to extract relevant indicators and metadata. The vulnerability identified here resides within the core parser logic located at opencti-platform/opencti-graphql/src/parser/json-mapper.ts, specifically affecting versions prior to 7.260706.0. This component is responsible for processing user-defined mapping rules that dictate how raw JSON data should be interpreted and stored within the platform's database. The flaw stems from an insufficient validation of regular expression complexity when utilizing the extractWithRegexp formula function, which compiles user-supplied patterns using the JavaScript RegExp engine without implementing safeguards against pathological inputs.
The technical nature of this vulnerability is a classic Regular Expression Denial of Service, commonly referred to as ReDoS. When a user with permission to create JSON mappers submits a crafted regular expression designed for catastrophic backtracking, such as those containing nested quantifiers or ambiguous alternations, the JavaScript engine may enter an exponential time complexity state during compilation or execution against specific input strings. Because Node.js operates on a single-threaded event loop architecture, this excessive computational load blocks the thread entirely. Consequently, the GraphQL API becomes unresponsive to all other requests, effectively causing a complete service outage for every user interacting with the OpenCTI platform. This behavior aligns directly with CWE-400, which describes conditions where resources are not properly controlled or limited, leading to denial of service scenarios.
The operational impact of this vulnerability is severe due to its potential for persistence and automation. An authenticated attacker does not need to continuously interact with the system to maintain the attack state; instead, they can configure a malicious mapper that triggers upon data ingestion. If scheduled ingests are configured to process feeds containing payloads matching the pathological pattern, the denial of service condition will recur repeatedly without further action from the attacker. This persistence mechanism exacerbates the impact by ensuring prolonged downtime and increasing the difficulty of recovery. Mitigation requires not only disabling or removing the malicious mapper but also restarting the OpenCTI application processes to clear any lingering state issues in the event loop. The vulnerability primarily affects availability rather than confidentiality or integrity, as it does not expose sensitive data nor allow for unauthorized modification of existing records.
To mitigate this risk and prevent future occurrences, organizations running affected versions must upgrade immediately to version 7.260706.0 or later, where the issue has been resolved through improved input validation and complexity checks on regular expressions. In environments where upgrading is not immediately feasible, administrators should restrict JSON mapper creation permissions to a minimal set of trusted users and implement strict monitoring for high CPU usage patterns that may indicate active exploitation attempts. Additionally, integrating Web Application Firewall rules or custom middleware to detect known catastrophic backtracking patterns can provide an additional layer of defense. This incident underscores the importance of validating all user-supplied input in server-side parsing logic, particularly when dealing with powerful engines like regular expressions that are susceptible to algorithmic complexity attacks as categorized under MITRE ATT&CK technique T1496, which involves resource exhaustion through denial of service mechanisms.