CVE-2026-63133

Received Received - Intake

Malcolm Archive Extraction Denial of Service

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-63133

Affected Vendors & Products

Vendor	Product	Version / Range
malcolm	network_traffic_analysis_tool_suite	to 26.07.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in Malcolm, a network traffic analysis tool. It occurs in the safe-extract.py script which extracts uploaded archives without limits on entry count, directory depth, total entries, or output size. A malicious archive with many entries can exhaust filesystem inodes or metadata, disrupting the processing pipeline and any services sharing the same mount.

Detection Guidance

Detecting this vulnerability involves monitoring filesystem resource usage and checking for excessive directory or file entries in extracted archives. Look for spikes in inode usage or filesystem metadata exhaustion on the filebeat processing container or shared mounts. Use commands like df -i to check inode usage and ls -R to inspect directory structures for unusually large entry counts.

Impact Analysis

The vulnerability can cause system-wide disruptions by consuming all available filesystem inodes or metadata. This may lead to service outages for Malcolm's processing pipeline and any other services relying on the same filesystem mount, resulting in degraded performance or complete unavailability.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting filesystem resources, potentially disrupting data processing and availability. This may impact compliance with standards like GDPR (data availability) or HIPAA (system integrity and access controls) if critical data processing is interrupted.

Mitigation Strategies

Upgrade Malcolm to version 26.07.0 or later to address the unbounded archive extraction issue. If immediate upgrade is not possible, restrict archive uploads to trusted sources and implement size or entry count limits for uploaded files. Monitor filesystem resources closely for signs of exhaustion.

Hi! I’m here to help you understand CVE-2026-63133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70