TI-2026-45069 CVE-2026-63133
Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
Priority MEDIUM 64
Malcolm is a network traffic analysis tool suite.
cisagov
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
cisagov records in CISA KEVNo cisagov vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-15970 CVE-2026-19671 · GHSA-3wrw-4pcx-6p2g
Improper handling of highly compressed data (data amplification) in CISA Malcolm
Priority MEDIUM 64
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits…
TI-2026-45070 CVE-2026-63134
Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Priority MEDIUM 57
Malcolm is a network traffic analysis tool suite.
TI-2026-15969 CVE-2026-19670 · GHSA-4887-2gc3-6j9r
Incorrect Authorization in CISA Malcolm
Priority MEDIUM 57
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g.
TI-2026-40197 CVE-2026-55676
Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
Priority MEDIUM 41
Malcolm is a network traffic analysis tool suite.
TI-2026-45083 CVE-2026-63177
Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Priority LOW 31
Malcolm is a network traffic analysis tool suite.