misp cti-transmute up to 1.4.0 activity_timeline days resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in misp cti-transmute up to 1.4.0. The affected element is an unknown function of the component activity_timeline. Such manipulation of the argument days leads to resource consumption. This vulnerability is documented as CVE-2026-69079. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in misp cti-transmute up to 1.4.0 and classified as problematic. Affected by this issue is an unknown part of the component activity_timeline. The manipulation of the argument days with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-69079 since 08/03/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Applying the patch 321892d26b82c8a5af1e210ee30735abb109fac2 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• misp

Name

• cti-transmute

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

Website

• Product: https://github.com/MISP/cti-transmute/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion