EUVD-2026-52255
GHSA-f6wp-5996-q84w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint requires no privileges or interaction; impact is purely availability with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range.
A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website.
The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
AnalysisAI
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the days query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The /activity_timeline endpoint must be network-reachable from the attacker - confirmed as the default exposure of the CTI-Transmute web interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) confirms that this endpoint is reachable over the network by any unauthenticated user with no preconditions, making automated or scripted abuse straightforward. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends repeated HTTP GET requests to `/activity_timeline?days=100000000` against an internet-exposed CTI-Transmute instance. Each request forces the application to execute unbounded database queries spanning implausibly large time windows, consuming significant DB I/O, CPU, and memory. … |
| Remediation | The upstream fix is available as commit 321892d26b82c8a5af1e210ee30735abb109fac2 in the MISP/cti-transmute GitHub repository (https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2); operators should apply this commit directly or pull the latest HEAD, as a named tagged release containing the fix has not been independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running CTI-Transmute and confirm their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cti Transmute
View allServer-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today