CVE-2026-63133 cisagov CVE debrief

Who should care

Defenders responsible for Malcolm installations, network traffic analysis, and security monitoring should assess exposure and prioritize upgrading to version 26.07.0 or later to prevent potential DoS attacks.

Why it matters

CVE-2026-63133 allows for a denial of service (DoS) attack on Malcolm installations prior to version 26.07.0. Defenders should prioritize verifying their installations and upgrading to prevent potential disruptions.

• Denial of service to the processing pipeline and shared services
• Exhaustion of inodes or filesystem metadata
• Potential disruption of network traffic analysis and security monitoring

Technical summary

The `safe-extract.py` script in Malcolm, a network traffic analysis tool suite, extracts uploaded archives without limits on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries can cause the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount.

Defensive priority

Defenders should prioritize verifying their Malcolm installations and upgrading to version 26.07.0 or later to prevent potential DoS attacks.

Recommended defensive actions

• Verify Malcolm installations and upgrade to version 26.07.0 or later
• Monitor for potential DoS attacks using malicious archives
• Review and limit archive extraction configurations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected systems is limited. Defenders should verify their installations and review configurations to prevent potential disruptions. The `safe-extract.py` script in Malcolm extracts uploaded archives without limits, which can lead to a denial of service. Evidence from the CVE record and NVD entry suggests that defenders should prioritize verifying their installations and be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.