CISA 2026-08-18

CISA Malcolm

Machine-generated analysis · WAYSCloud LLM

Versions of Malcolm prior to 26.07.0 allow unbounded archive extraction, which can exhaust filesystem resources and cause denial of service.

Context

Malcolm is a network traffic analysis tool suite. The advisory states that safe-extract.py extracts uploaded archives without limits on entry count, depth, or size, enabling a crafted archive to exhaust inodes and deny service. Version 26.07.0 addresses the issue. The vulnerability affects worldwide deployments in the information technology sector.

Operator considerations

Check: verify the installed Malcolm version is earlier than 26.07.0.
Patch: upgrade to Malcolm version 26.07.0 or later.
Log: monitor filebeat processing logs for errors related to inode exhaustion or failed archive extraction.
Isolate: consider restricting the filebeat processing container’s mount to limit impact of resource exhaustion.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.

The following versions of CISA Malcolm are affected:

Malcolm

Read the full advisory on CISA →