What is CVE-2026-107335?

CVE-2026-107335 is a medium-severity vulnerability in Cisa Malcolm, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 6.5/10. Published 2026-10-08.

How severe is CVE-2026-107335?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Cisa Malcolm

CVE-2026-107335

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.

Published 2026-10-08.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Cisa Malcolm

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

Frequently asked questions

What is CVE-2026-107335?: CVE-2026-107335 is a medium-severity vulnerability in Cisa Malcolm, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 6.5/10. Published 2026-10-08.
How severe is CVE-2026-107335?: Medium severity. CVSS v3 base score is 6.5 out of 10.