CVE-2026-76821: OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in opencti-platform/opencti-graphql/src/parser/json-mapper.ts without validating its complexity. An authenticated user with JSON mapper creation permission could provide a catastrophically backtracking pattern and matching ingestion input, blocking the Node.js event loop and making the GraphQL API unavailable to all users. Scheduled ingestion could repeatedly execute the malicious mapper without additional attacker action, and recovery could require disabling the mapper and restarting the process. The issue affects availability and does not expose or modify data. This issue is fixed in version 7.260706.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opencti-platform/opencti-graphqlto a version that resolves this vulnerability.Fixed in 7.260706.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenCTI user must have permission to create JSON mappers. Exploitation also requires supplying both a catastrophically backtracking regular expression and ingestion input that triggers the expensive match.
What is the operational impact?
A successful pattern can block the Node.js event loop, making the GraphQL API unavailable to all users. The issue affects availability only; the provided information does not indicate data exposure or modification.
Can the outage persist without further attacker activity?
Yes. If the malicious mapper is used by scheduled ingestion, it can be executed repeatedly without additional attacker action. Recovery may require disabling the mapper and restarting the affected process.
What should be done if an immediate upgrade is not possible?
Disable suspected or untrusted JSON mappers, particularly those containing user-supplied regular expressions, and stop scheduled ingestions that invoke them. Restart the process after disabling a mapper that has blocked the event loop.
Which versions are fixed?
The issue is fixed in version 7.260706.0. Versions prior to 7.260706.0 are affected according to the provided information.