CyberRota Analysis
AI-GeneratedMalcolm's `safe-extract.py` prior to version 26.07.0 is vulnerable to denial-of-service attacks due to its lack of limits on the number of entries, directory depth, and output size when extracting uploaded archives. An attacker can exploit this by uploading a malicious archive that generates excessive filesystem objects, potentially exhausting inodes and disrupting the processing pipeline. Organizations using Malcolm for network traffic analysis should prioritize upgrading to version 26.07.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.