CVE-2026-76821: OpenCTI JSON Mapper ReDoS Vulnerability

CVE-2026-76821 Overview

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. CVE-2026-76821 is a regular expression denial-of-service (ReDoS) flaw affecting OpenCTI versions prior to 7.260706.0. The JSON ingestion mapper's extractWithRegexp formula function compiled user-supplied regular expressions with the native JavaScript RegExp engine without complexity validation. An authenticated user with JSON mapper creation permission can supply a catastrophically backtracking pattern that blocks the Node.js event loop, rendering the GraphQL API unavailable to all users. The issue is classified as [CWE-400] Uncontrolled Resource Consumption and is fixed in version 7.260706.0.

Critical Impact
A single malicious JSON mapper can freeze the Node.js event loop and make the entire OpenCTI GraphQL API unavailable. Scheduled ingestion may repeatedly re-trigger the condition without further attacker interaction.

Affected Products

OpenCTI Platform versions prior to 7.260706.0
opencti-graphql component, file opencti-platform/opencti-graphql/src/parser/json-mapper.ts
Deployments exposing JSON mapper creation permissions to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-76821 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76821

Vulnerability Analysis

The vulnerability resides in the extractWithRegexp formula function inside opencti-platform/opencti-graphql/src/parser/json-mapper.ts. The function accepts a user-supplied regular expression string and compiles it directly with JavaScript's built-in RegExp engine. That engine uses a backtracking NFA implementation, which exhibits exponential worst-case time complexity for certain pattern classes.

When an authenticated user with JSON mapper creation permission submits a catastrophically backtracking pattern and matching ingestion input, the regex engine consumes CPU indefinitely on the single Node.js worker thread. Because Node.js executes JavaScript on one event loop, all concurrent GraphQL requests stall until the operation completes or the process is killed.

Scheduled ingestion compounds the impact. A mapper stored once can be executed repeatedly by the scheduler without further attacker action, so restarting the process alone does not restore service — operators must disable the offending mapper first. The vulnerability affects availability only; it does not expose or modify stored intelligence data.

Root Cause

The root cause is missing input validation on regex complexity before compilation with an unsafe engine. The pre-patch code path trusted the caller and delegated pattern execution to RegExp, which lacks execution timeouts or backtracking limits.

Attack Vector

Exploitation requires network access to the GraphQL API and an authenticated account with mapper creation privileges. The attacker creates a JSON mapper containing a malicious regex, then supplies matching ingestion input either directly or via a scheduled ingestion job.

typescript

// Security patch — introduces RE2, a linear-time regex engine
// File: opencti-platform/opencti-graphql/src/parser/json-mapper.ts

import * as JSONPath from 'jsonpath-plus';
import RE2 from 're2';

import { v4 as uuidv4 } from 'uuid';
import type { StixObject } from '../types/stix-2-1-common';

Source: OpenCTI commit 3d726c0

The patch replaces the vulnerable RegExp compilation with the re2 library, a Google-developed engine that guarantees linear-time matching by disallowing backtracking constructs.

Detection Methods for CVE-2026-76821

Indicators of Compromise

Sustained 100% CPU utilization on the OpenCTI GraphQL Node.js process without corresponding request throughput
GraphQL API timeouts or connection failures affecting all users simultaneously
Recently created or modified JSON mappers referencing extractWithRegexp with complex regex patterns containing nested quantifiers (e.g., (a+)+, (a|a)*)
Repeated event loop stalls correlated with scheduled ingestion job execution windows

Detection Strategies

Audit the OpenCTI mapper repository for extractWithRegexp invocations containing nested repetition, alternation with overlap, or unbounded quantifiers
Enable Node.js event loop lag metrics and alert when lag exceeds a normal-operations threshold
Correlate GraphQL API unavailability windows with scheduled ingestion job identifiers in application logs

Monitoring Recommendations

Track creation and modification events for JSON mappers, capturing the acting user account and full mapper definition
Monitor process-level CPU consumption for the opencti-graphql service and alert on sustained saturation
Log all authenticated actions performed by accounts holding mapper creation permissions for post-incident review

How to Mitigate CVE-2026-76821

Immediate Actions Required

Upgrade OpenCTI to version 7.260706.0 or later, which replaces the JavaScript RegExp engine with re2 for user-supplied patterns
Review and restrict the role-based permission set that grants JSON mapper creation to the minimum required users
Audit existing JSON mappers for pathological regex patterns and remove or rewrite any suspicious entries before upgrading

Patch Information

The fix is available in OpenCTI release 7.260706.0. The remediation is documented in GitHub Security Advisory GHSA-7g3x-wc2m-9h9x and implemented in pull request #16935. The patch introduces the re2 dependency to guarantee linear-time regex matching in json-mapper.ts.

Workarounds

Revoke JSON mapper creation permissions from all non-administrative accounts until the upgrade is complete
Disable scheduled ingestion jobs that reference user-authored mappers to prevent repeated event loop stalls
If a hang is observed, disable the offending mapper before restarting the Node.js process — a restart alone will not restore service if scheduled ingestion re-triggers the mapper

bash

# Verify installed OpenCTI version and upgrade via Docker Compose
docker exec opencti-server cat /opt/opencti/package.json | grep version

# Pin the fixed image in docker-compose.yml, then apply
# image: opencti/platform:7.260706.0
docker compose pull opencti
docker compose up -d opencti