CVE-2026-19671: Malcolm Upload Pipeline DoS Vulnerability

CVE-2026-19671 Overview

CVE-2026-19671 is a resource exhaustion vulnerability in Malcolm, the network traffic analysis platform maintained by CISA. The flaw resides in the upload-processing pipeline implemented by scripts/safe-extract.py. Malcolm enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives such as zip, tar, rar, and 7z through libarchive. Those limits are not applied to single-stream compressed formats including .gz, .bz2, .xz, .lzma, and .lz when the payload is not a .tar.* archive. Any authenticated user with upload rights can submit a small decompression bomb that expands without bound, filling the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek [CWE-409].

Critical Impact
An authenticated low-privilege user can exhaust Malcolm's shared storage volume with a single gzip-bomb upload, disrupting log ingestion and analysis for all platform users.

Affected Products

Malcolm (network traffic analysis suite maintained by CISA)
scripts/safe-extract.py upload-processing pipeline
Backing services sharing the Docker volume: OpenSearch, Logstash, Arkime, Zeek

Discovery Timeline

2026-08-18 - CVE-2026-19671 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-19671

Vulnerability Analysis

Malcolm accepts PCAP and log files from authenticated users and routes them through scripts/safe-extract.py. The script applies safety limits when the uploaded file is a container archive that libarchive can enumerate. Those limits cap entry counts, nesting depth, and total uncompressed bytes to prevent zip-bomb style attacks.

Single-stream compressed formats fall outside that control path. When a user uploads a .gz, .bz2, .xz, .lzma, or .lz file that is not wrapping a tar archive, the extractor streams the decompressed output to disk without checking the resulting size. A highly compressible payload of a few kilobytes can expand to hundreds of gigabytes or more.

The decompressed file lands on the Docker volume shared by OpenSearch, Logstash, Arkime, and Zeek. Once that volume fills, indexing halts, log pipelines stall, and existing analysis sessions degrade or fail. Recovery requires operator intervention to identify and remove the oversized artifact.

Root Cause

The root cause is inconsistent enforcement of decompression safety limits across supported input formats. Container-archive handling honors entry, depth, and byte caps, but the single-stream decompression branch writes output to disk without an equivalent byte ceiling or streaming quota check.

Attack Vector

Exploitation requires network access to the Malcolm upload interface and valid credentials with upload permission. The attacker crafts a decompression bomb by compressing a large stream of null bytes using gzip, xz, or another supported single-stream codec, then uploads the file through the normal PCAP or log submission path. No user interaction beyond the attacker's authenticated session is needed. Consult the GitHub Security Advisory GHSA-f2v6-8cj4-mhr6 and CISA ICS Advisory ICSA-26-230-01 for vendor detail.

No verified proof-of-concept code has been published. The vulnerability mechanism is documented in prose in the referenced advisories.

Detection Methods for CVE-2026-19671

Indicators of Compromise

Sudden growth of the Malcolm Docker volume backing OpenSearch, Logstash, Arkime, or Zeek, disproportionate to observed upload sizes.
Upload records for .gz, .bz2, .xz, .lzma, or .lz files that are small on receipt but produce very large extracted artifacts under the Malcolm ingest directory.
OpenSearch or Logstash errors indicating no space left on device shortly after a user upload event.

Detection Strategies

Correlate Malcolm upload audit logs with filesystem df or container volume metrics to flag upload events followed by rapid free-space decline.
Alert on any single extraction where the on-disk output exceeds a defined multiple of the uploaded payload size, for example a 100x expansion ratio.
Track failure signals from downstream services (Zeek, Arkime, Logstash) that commonly indicate volume exhaustion.

Monitoring Recommendations

Instrument the Docker host with volume capacity alerts at 70%, 85%, and 95% thresholds.
Retain upload metadata (uploader identity, original filename, compressed size, extracted size) for post-incident review.
Forward Malcolm container logs to a centralized analytics tier so decompression anomalies can be queried across the fleet.

How to Mitigate CVE-2026-19671

Immediate Actions Required

Apply the Malcolm update referenced in GHSA-f2v6-8cj4-mhr6 once available in your channel.
Restrict upload permissions to trusted operator accounts until patched.
Review recent uploads for oversized decompressed artifacts and reclaim disk space.

Patch Information

Refer to the GitHub Security Advisory GHSA-f2v6-8cj4-mhr6 and CISA ICS Advisory ICSA-26-230-01 for the fixed Malcolm release and upgrade instructions. The fix extends the existing safe-extract byte cap to cover single-stream compressed formats.

Workarounds

Enforce a filesystem quota on the Malcolm upload extraction directory to bound per-upload disk usage.
Reject single-stream compressed uploads (.gz, .bz2, .xz, .lzma, .lz) at an upstream reverse proxy or WAF until the patch is deployed.
Require operators to submit only .pcap, .pcapng, or tar-wrapped archives that pass the existing safe-extract limits.

bash

# Example: block single-stream compressed uploads at nginx until patched
location /upload/ {
    if ($request_filename ~* \.(gz|bz2|xz|lzma|lz)$) {
        return 415;
    }
    proxy_pass http://malcolm_upstream;
}