CVE-2026-107335 CISA CVE debrief

Who should care

Authenticated users with upload permissions, administrators of Malcolm installations, security teams responsible for monitoring and mitigating potential impacts, and operators of affected platforms should review the vulnerability and take necessary actions to mitigate potential impacts.

Why it matters

CVE-2026-107335 allows authenticated users to disrupt the Malcolm platform via highly compressible files, requiring review of upload permissions and monitoring of uploaded file sizes.

• Potential disruption of the Malcolm platform for all users
• Exhaustion of shared Docker volume resources
• Possible impact on OpenSearch, Logstash, Arkime, and Zeek functionality

Technical summary

Malcolm's upload-processing pipeline does not apply limits when extracting single-stream compressed formats, allowing authenticated users to upload highly compressible files that can decompress to an effectively unbounded size, exhausting the shared Docker volume and disrupting the platform. The vulnerability exists in the upload-processing pipeline (scripts/safe-extract.py) and affects the platform's functionality, including OpenSearch, Logstash, Arkime, and Zeek. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority for authenticated users with upload permissions

Recommended defensive actions

• Review and limit upload permissions for authenticated users
• Monitor and restrict the size of uploaded files
• Implement additional validation and filtering for compressed files
• Consider applying compensating controls to mitigate potential impact
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Malcolm's upload-processing pipeline. The NVD entry is currently UNCHANGED. The vulnerability allows authenticated users to upload highly compressible files that can decompress to an effectively unbounded size, exhausting the shared Docker volume and disrupting the platform. Defenders should verify the affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.