Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T21:17:44.167Z",
  "pubdate": "2026-08-11T21:17:44.167Z",
  "executiveSummary": "Malcolm, a network traffic analysis tool suite, contains a denial of service vulnerability in the archive extraction functionality prior to version 26.07.0. The vulnerability stems from an absence of resource constraints during the processing of uploaded archive files.\nSpecifically, the safe-extract.py script fails to enforce limits on entry count, directory depth, total extracted entries, and total output size.\nAn authenticated or otherwise capable attacker who can upload malicious archives can exploit this flaw by submitting a specially crafted archive containing an exorbitant number of nested directories or individual file entries.\nWhen processed, the filebeat processing container attempts to extract all filesystem objects without restriction, exhausting available inode allocations or filesystem metadata capacity on the underlying storage mount.\nThis resource exhaustion directly results in a denial of service condition, disrupting the core log processing pipeline and inadvertently impacting any co-located service sharing the identical storage mount.\nMitigation requires upgrading the Malcolm deployment to version 26.07.0 or later, which introduces proper bounds checking and resource limits within the extraction routine.",
  "technicalDetails": "The vulnerability resides within the safe-extract.py script utilized by the Malcolm network traffic analysis tool suite for handling uploaded archive payloads prior to version 26.07.0.\nThe root cause of the vulnerability is the absence of programmatic bounds checking and resource quotas during archive decompression and file creation operations. The vulnerable component lacks enforcement mechanisms for critical archive metrics, including individual entry counts, maximum directory depth, aggregate file entries, and total cumulative output size.\nTo exploit this flaw, an attacker crafts a malicious archive designed to maximize metadata consumption while minimizing physical payload size, commonly referred to as a \"zip bomb\" or inode-exhaustion vector. This archive contains millions of nested directory structures or individual empty file entries.\nThe attack flow proceeds as follows: First, the malicious archive is ingested by the Malcolm processing workflow. Subsequently, the filebeat processing container passes the archive to safe-extract.py for extraction. Because the script does not validate structural constraints prior to iterating over archive contents, the extraction routine proceeds to recursively instantiate filesystem objects on the host or container mount point.\nAs the filebeat processing container executes the unbounded creation of directories and files, it rapidly consumes all available filesystem inodes and metadata storage. This abrupt exhaustion of filesystem resources causes critical kernel operations related to file creation and I/O to fail.\nConsequently, the filebeat processing container crashes or hangs, halting the log ingestion pipeline entirely. Furthermore, because the exhaustion occurs at the filesystem level, any auxiliary services or shared applications utilizing the exact same storage mount suffer cascading failures and collateral denial of service.\nThe vulnerability affects all Malcolm installations running versions prior to 26.07.0. Exploitation relies on the application's ingestion interface accepting untrusted archive inputs, which are then processed by the privileged or operational container context executing safe-extract.py."
}