Read the docs
TI-2026-69638 Aliases CVE-2026-107335GHSA-ffq8-c9hx-7wvf

Compressed file uploads in Malcolm can exhaust shared disk space

Priority MEDIUM 62CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Malcolm versions from 0 through 26.07.1 are affected. Size limits are not applied to single-stream compressed uploads such as .gz or .xz files (CWE-409). An authenticated user who can upload PCAP or log files can send a small file that expands to an unbounded size, filling the shared Docker volume and disrupting the platform for all users.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed Malcolm (CISA): 26.08.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISAMalcolmup to 26.07.126.08.0Patch availableCNA
  • Malcolm VendorCISA Affected up to 26.07.1 Fixed in 26.08.0 Patch available CNA

Remediation

Upgrade Malcolm to 26.08.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Malcolm (CISA) Fixed in 26.08.0

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107335
  2. 2026-10-09 Alias added: GHSA-ffq8-c9hx-7wvf
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-13 1 new reference · CNA

References

Other 2

  • TI-2026-69642 Server-side request forgery in Malcolm file upload component CVSS 3.1HIGH 7.1
  • TI-2026-69640 Cross-Site Request Forgery in Malcolm CVSS 3.1HIGH 7.1
  • TI-2026-69637 Incorrect authorization in Malcolm exposes role-restricted paths CVSS 3.1MEDIUM 5.4
  • TI-2025-24590 CISA Thorium download stream divide by zero CVSS 4.0MEDIUM 5.3
  • TI-2025-24585 CISA Thorium insecure downloaded file path validation CVSS 4.0MEDIUM 5.3
  • TI-2025-41377 Software Acquisition Guide Supplier Response Web Tool XSS CVSS 4.0MEDIUM 4.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences