Executive brief
OpenCTI is an open-source threat intelligence platform that ingests and manages cyber threat data. An authenticated user with JSON mapper creation privileges can upload a malicious regular expression that causes catastrophic backtracking, blocking the GraphQL API and making the platform unavailable to all users. Scheduled ingestion tasks can automatically re-trigger the attack without further attacker action, requiring service restart to recover.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the extractWithRegexp formula function within opencti-platform/opencti-graphql/src/parser/json-mapper.ts. The function compiles user-supplied regular expressions using the JavaScript RegExp engine without validating pattern complexity, allowing an authenticated attacker to provide a catastrophically backtracking pattern. When the malicious regex is matched against ingestion input, it blocks the Node.js event loop, making the GraphQL API unavailable. The attack requires authentication and JSON mapper creation permission. Patches are available in version 7.260706.0 and later; the fix implements validation using the re2 library (1.25.0) to prevent pathological regex patterns.
Affected products
- OpenCTI-Platform OpenCTI prior to 7.260706.0
Timeline
- 2026-09-15: disclosed
- 2026-07-02: patched: Fix committed; version 7.260706.0 includes the patch