CVE-2026-63133 Overview
CVE-2026-63133 is a resource exhaustion vulnerability in Malcolm, a network traffic analysis tool suite maintained by CISA. The flaw resides in safe-extract.py, which extracts uploaded archives without enforcing limits on entry count, directory depth, total entries, or output size. An authenticated attacker can upload a small malicious archive containing a large number of directory or file entries. The filebeat processing container then creates an unbounded number of filesystem objects, exhausting inodes or filesystem metadata. This denies service to the processing pipeline and any service sharing the same mount. The issue is fixed in version 26.07.0 and is classified under CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
Authenticated attackers can exhaust filesystem inodes on the Malcolm host, disrupting the processing pipeline and any co-located services sharing the mount.
Affected Products
- CISA Malcolm network traffic analysis suite prior to version 26.07.0
- Filebeat processing container within Malcolm deployments
- Services sharing the same filesystem mount as the Malcolm processing pipeline
Discovery Timeline
- 2026-08-11 - CVE-2026-63133 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-63133
Vulnerability Analysis
Malcolm ingests packet captures and Zeek logs uploaded by operators for analysis. The safe-extract.py helper handles archive extraction during upload processing. The script did not enforce quantitative limits on the archives it processed. An attacker with upload privileges can supply a compact archive that expands into millions of directory or file entries.
Extraction proceeds inside the filebeat processing container. Each created entry consumes an inode and filesystem metadata blocks on the underlying volume. Once inodes are exhausted, the volume rejects new file creations even when free space remains. This halts the analysis pipeline and cascades to any container or host process that shares the mount.
The attack requires only low privileges and no user interaction, and the network attack vector allows exploitation through Malcolm's upload interface.
Root Cause
The root cause is missing input validation on archive contents before extraction. safe-extract.py did not check entry counts, cumulative uncompressed size, per-file size, or nesting depth. This is a canonical CWE-770 failure to throttle resource allocation driven by untrusted input.
Attack Vector
An authenticated user uploads a crafted archive through Malcolm's normal ingestion path. The archive is small on disk but declares a very large number of entries. When safe-extract.py iterates the archive, the container writes each entry to the shared filesystem until inodes or metadata blocks are exhausted. No memory corruption or code execution occurs; the impact is availability loss for the processing pipeline and dependent services.
Refer to the GitHub Security Advisory GHSA-c35g-mgc3-95rx for the maintainer's technical description.
Detection Methods for CVE-2026-63133
Indicators of Compromise
- Rapid depletion of inodes on volumes mounted into the Malcolm filebeat processing container, observable via df -i.
- Filebeat or upload-processing container logs showing sustained extraction activity or ENOSPC errors despite available disk space.
- Directories under the Malcolm upload processing path containing an unusually high number of nested subdirectories or zero-byte files.
Detection Strategies
- Monitor inode utilization and file creation rates on Malcolm host volumes and alert on sharp increases correlated with upload events.
- Correlate authenticated upload activity with subsequent filesystem metadata growth to identify abusive archives.
- Review Malcolm authentication logs for accounts uploading archives that trigger extraction failures or pipeline stalls.
Monitoring Recommendations
- Instrument container-level metrics for open file descriptors, inode counts, and per-container disk write rates.
- Log every invocation of safe-extract.py with source user, archive size, and resulting entry count for audit review.
- Alert on filebeat pipeline stalls or restart loops that coincide with recent uploads.
How to Mitigate CVE-2026-63133
Immediate Actions Required
- Upgrade Malcolm to version 26.07.0 or later, which fixes the unbounded extraction behavior in safe-extract.py.
- Restrict upload access to trusted operators until the upgrade is applied.
- Provision Malcolm processing volumes with dedicated filesystems so exhaustion cannot impact unrelated services on the host.
Patch Information
The maintainers addressed CVE-2026-63133 in the Malcolm v26.07.0 release. Full advisory details are available in GitHub Security Advisory GHSA-c35g-mgc3-95rx. Operators should validate the deployment version after upgrade and confirm the filebeat processing container is running the patched image.
Workarounds
- Enforce strict quotas on the volume backing the filebeat processing container to cap inode and space consumption per upload.
- Reject archive uploads at a reverse proxy or ingestion gateway when they exceed defined size or entry-count thresholds.
- Isolate the Malcolm processing pipeline on a dedicated mount to contain availability impact if abusive uploads occur.
# Configuration example: apply an XFS project quota to the Malcolm upload volume
# to contain inode exhaustion caused by malicious archives.
echo "100:/var/lib/malcolm/upload" >> /etc/projects
echo "malcolm_upload:100" >> /etc/projid
xfs_quota -x -c 'project -s malcolm_upload' /var/lib/malcolm
xfs_quota -x -c 'limit -p bhard=20g ihard=500000 malcolm_upload' /var/lib/malcolm
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
