CVE-2026-63133: Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolm network traffic analysis tool suite (safe-extract.py)to a version that resolves this vulnerability.Fixed in 26.07.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63133?
CVE-2026-63133 has a medium severity rating of 6.5.
What type of vulnerability is associated with CVE-2026-63133?
CVE-2026-63133 is classified as an Uncontrolled Resource Consumption vulnerability, specifically leading to an Inode-Exhaustion Denial of Service.
How do I fix CVE-2026-63133?
To fix CVE-2026-63133, upgrade to Malcolm version 26.07.0 or later, where the archiving extraction process is properly limited.
What are the potential impacts of CVE-2026-63133?
The potential impact of CVE-2026-63133 includes denial of service due to excessive resource consumption when handling large or malicious archive files.
What component of Malcolm is affected by CVE-2026-63133?
The affected component of Malcolm is the `safe-extract.py` script used for extracting uploaded archives.