Is CVE-2026-19671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19671 being exploited in the wild.

How severe is CVE-2026-19671?

Medium severity, with a CVSS score of 6.5, published 18 August 2026.

Is there a fix for CVE-2026-19671?

A patch was published on 2026-08-18: Fixed in Malcolm v26.08.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19671 attacked?

It is attacked over the network.

Am I affected by CVE-2026-19671?

Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19671: CISA Malcolm archive bomb bypass in single-stream compression

CVE-2026-19671 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Malcolm is a network traffic analysis tool that processes uploaded PCAP and log files. When an authenticated user uploads a highly compressed file (such as a gzip bomb) in single-stream formats like .gz or .bz2, the system fails to enforce decompression limits and can exhaust the shared Docker storage volume, causing service outages for all users analyzing network traffic.

Technologies: CISA Malcolm. Vendors: CISA.

Quick answers

Is CVE-2026-19671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19671 being exploited in the wild.
How severe is CVE-2026-19671?: Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?: CISA Malcolm <=26.07.1.
Is there a fix for CVE-2026-19671?: A patch was published on 2026-08-18: Fixed in Malcolm v26.08.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19671 attacked?: It is attacked over the network.
Am I affected by CVE-2026-19671?: Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in scripts/safe-extract.py, which dispatches archive extraction based on file type. The _extract_libarchive() function enforces ARCHIVE_EXTRACT_MAX_ENTRIES, ARCHIVE_EXTRACT_MAX_DEPTH, and ARCHIVE_EXTRACT_MAX_TOTAL_BYTES (default 4 GiB) limits for multi-entry archives, but the _extract_raw_stream() and _extract_lzip() functions that handle single-stream compressed formats (.gz, .bz2, .xz, .lzma, .lz) perform unbounded decompression with no size accounting. An authenticated user with upload privileges can upload a small, highly compressible file (e.g., a 2 MB gzip bomb) that decompresses to multiple gigabytes, exhausting disk space on the shared /zeek Docker volume used by OpenSearch, Logstash, Arkime, and Zeek. The fix is available in version 26.08.0, and patched versions also addressed related issues in versions 26.06.1 and 26.07.0.

Affected products

CISA Malcolm <=26.07.1

Timeline

2026-07-28: disclosed
2026-08-18: advisory
2026-08-18: patched: Fixed in Malcolm v26.08.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.