Intelligence online17 sources monitored16 actively exploited 7d25 published 24hChecked recently
Vulnerability record

CVE-2026-107335

ElevatedNo known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

Description

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdate

    CVE-2026-107335 scored CVSS 6.5

    Basis: NIST National Vulnerability Database

Coverage

HighReview

CISA Malcolm

CISA Cybersecurity AdvisoriesEnterpriseDevelopersCritical infra

References

  • github.com https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
  • github.com https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6
  • github.com https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g