EUVD-2026-56969Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable upload interface (AV:N), no special conditions (AC:L), authenticated low-privilege user required (PR:L), availability impact only via inode exhaustion (A:H), no scope change (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.
AnalysisAI
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the entire processing pipeline. Prior to version 26.07.0, the safe-extract.py script imposes no limits on the count, depth, or output size of entries extracted from uploaded archives, enabling a low-privilege attacker to craft a small archive that expands into an unbounded number of filesystem objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege account on the Malcolm instance with sufficient permission to upload archives for processing - this is the PR:L gate reflected in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Malcolm user uploads a specially crafted archive - small in compressed byte size but containing tens of thousands of nested directory entries or tiny files. When `safe-extract.py` processes the archive without entry-count or depth limits, the filebeat container creates an unbounded number of filesystem objects on its mount, consuming all available inodes. … |
| Remediation | Upgrade Malcolm to version 26.07.0, which fixes the issue by enforcing resource limits within `safe-extract.py`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restr
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary direct
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today