# CVE-2026-76821: OpenCTI JSON mapper ReDoS via unvalidated regular expression

Source: https://junglewise.ai/threats/cve-2026-76821-opencti-json-mapper-redos-via-unvalidated-regular-expression  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76821 · Severity: info · Published 2026-09-15

OpenCTI is an open-source threat intelligence platform that ingests and manages cyber threat data. An authenticated user with JSON mapper creation privileges can upload a malicious regular expression that causes catastrophic backtracking, blocking the GraphQL API and making the platform unavailable to all users. Scheduled ingestion tasks can automatically re-trigger the attack without further attacker action, requiring service restart to recover.

## Quick answers

**Is CVE-2026-76821 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76821 being exploited in the wild.

**How severe is CVE-2026-76821?** Informational severity, published 15 September 2026.

**Which products and versions are affected?** OpenCTI-Platform OpenCTI prior to 7.260706.0.

**Is there a fix for CVE-2026-76821?** A patch was published on 2026-07-02: Fix committed; version 7.260706.0 includes the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76821 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76821?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the extractWithRegexp formula function within opencti-platform/opencti-graphql/src/parser/json-mapper.ts. The function compiles user-supplied regular expressions using the JavaScript RegExp engine without validating pattern complexity, allowing an authenticated attacker to provide a catastrophically backtracking pattern. When the malicious regex is matched against ingestion input, it blocks the Node.js event loop, making the GraphQL API unavailable. The attack requires authentication and JSON mapper creation permission. Patches are available in version 7.260706.0 and later; the fix implements validation using the re2 library (1.25.0) to prevent pathological regex patterns.

## Affected products

- OpenCTI-Platform OpenCTI prior to 7.260706.0

## Timeline

- 2026-09-15: disclosed
- 2026-07-02: patched: Fix committed; version 7.260706.0 includes the patch

## References

- [https://github.com/OpenCTI-Platform/opencti/commit/3d726c09480f96980ce4c3e6119a8034dbdf2c96](https://github.com/OpenCTI-Platform/opencti/commit/3d726c09480f96980ce4c3e6119a8034dbdf2c96)
- [https://github.com/OpenCTI-Platform/opencti/pull/16935](https://github.com/OpenCTI-Platform/opencti/pull/16935)