CVE-2026-69079
Received Received - Intake

Uncontrolled Resource Consumption in CTI-Transmute

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69079
EUVD
EUVD-2026-52255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cti-transmute cti-transmute to 1095 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CTI-Transmute has an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled 'days' query parameter without restrictions, allowing attackers to submit excessively large values. This causes the application to process activity data over an arbitrarily large period, consuming excessive database, CPU, or memory resources.

Detection Guidance

Check for unusual activity in the /activity_timeline endpoint by monitoring HTTP requests with excessively large 'days' parameter values. Look for repeated requests to this endpoint with values exceeding 1,095 days.

Impact Analysis

An attacker could degrade system performance by consuming excessive resources, delaying concurrent requests, or triggering server errors. Repeated exploitation could lead to reduced availability of the CTI-Transmute website, potentially disrupting normal operations.

Mitigation Strategies

Apply the patch that clamps the 'days' parameter to a minimum of 1 day and a maximum of 1,095 days. Implement rate limiting on the /activity_timeline endpoint to prevent abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart