CISA Malcolm up to 26.07.1 Upload Processing Pipeline scripts/safe-extract.py resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in CISA Malcolm up to 26.07.1. Impacted is an unknown function of the file scripts/safe-extract.py of the component Upload Processing Pipeline. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-107335. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in CISA Malcolm up to 26.07.1 and classified as problematic. Affected by this issue is some unknown functionality of the file scripts/safe-extract.py of the component Upload Processing Pipeline. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-107335 since 10/07/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 26.08.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• CISA

Name

• Malcolm

Version

• 26.07.0
• 26.07.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion