Skip to main content

CTI-Transmute EUVDEUVD-2026-52255

| CVE-2026-69079 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-08-03 CIRCL GHSA-f6wp-5996-q84w
Denial Of Service Cti Transmute
8.7
CVSS 4.0 · Vendor: CIRCL
Share

Severity by source

Vendor (CIRCL) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-accessible unauthenticated endpoint requires no privileges or interaction; impact is purely availability with no confidentiality or integrity effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 03, 2026 - 10:32 vuln.today
Analysis Generated
Aug 03, 2026 - 10:32 vuln.today
CVE Published
Aug 03, 2026 - 09:22 cve.org
HIGH 8.7

DescriptionCVE.org

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range.

A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website.

The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

AnalysisAI

Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers to exhaust database, CPU, and memory resources by submitting arbitrarily large values for the days query parameter. All versions of the MISP project's CTI-Transmute tool are affected until the upstream patch is applied; the fix clamps the parameter to a 1-1,095 day range. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify internet-exposed CTI-Transmute instance
Delivery
Send unauthenticated GET /activity_timeline?days=<arbitrarily_large_value>
Exploit
Application executes unbounded DB query over excessive time range
Execution
Database/CPU/memory resources exhausted
Impact
Repeat requests to sustain denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The /activity_timeline endpoint must be network-reachable from the attacker - confirmed as the default exposure of the CTI-Transmute web interface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) confirms that this endpoint is reachable over the network by any unauthenticated user with no preconditions, making automated or scripted abuse straightforward. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends repeated HTTP GET requests to `/activity_timeline?days=100000000` against an internet-exposed CTI-Transmute instance. Each request forces the application to execute unbounded database queries spanning implausibly large time windows, consuming significant DB I/O, CPU, and memory. …
Remediation The upstream fix is available as commit 321892d26b82c8a5af1e210ee30735abb109fac2 in the MISP/cti-transmute GitHub repository (https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2); operators should apply this commit directly or pull the latest HEAD, as a named tagged release containing the fix has not been independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running CTI-Transmute and confirm their current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cti Transmute

View all
CVE-2026-69078 HIGH
8.8 Aug 03

Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inje
CVE-2026-69082 HIGH
8.8 Aug 03

Cross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
CVE-2026-72759 MEDIUM
6.9 Aug 10

Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion

CVE-2026-9806 MEDIUM
6.3 May 28

Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
CVE-2026-73155 MEDIUM
5.3 Aug 11

Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
CVE-2026-73140 MEDIUM
5.3 Aug 11

Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with

CVE-2026-73162 MEDIUM
5.3 Aug 11

Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
CVE-2026-72760 MEDIUM
5.3 Aug 10

Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
CVE-2026-71502 MEDIUM
5.1 Aug 06

Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
CVE-2026-72751 MEDIUM
5.1 Aug 10

Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
CVE-2026-73158 MEDIUM
5.1 Aug 11

Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
CVE-2026-73157 LOW
2.3 Aug 11

Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-52255 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy