CVE-2026-63133

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/Malcolm/releases/tag/v26.07.0
https://github.com/cisagov/Malcolm/security/advisories/GHSA-c35g-mgc3-95rx
https://github.com/cisagov/Malcolm/security/advisories/GHSA-c35g-mgc3-95rx

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-11 21:17

Updated : 2026-09-09 20:46

NVD link : CVE-2026-63133

Mitre link : CVE-2026-63133

CVE.ORG link : CVE-2026-63133

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-63133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63133", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T13:01:08.328295Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cisagov", "product": "Malcolm", "versions": [{"status": "affected", "version": "< 26.07.0"}]}]}], "published": "2026-08-11T21:17:44.167", "references": [{"url": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-c35g-mgc3-95rx", "source": "security-advisories@github.com"}, {"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-c35g-mgc3-95rx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue."}], "lastModified": "2026-09-09T20:46:28.353", "sourceIdentifier": "security-advisories@github.com"}