Malcolm’s upload‑processing pipeline enforces limits only when extracting container archives, but those limits are not applied to single‑stream compressed formats such as .gz or .xz. An authenticated user can upload a highly compressible file that decompresses to an effectively unbounded size on disk. The resulting disk consumption exhausts the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, leading to service disruption for all users.

The issue impacts Malcolm versions prior to v26.08.0. Any installation that allows authenticated uploads of PCAP or log files and shares a Docker volume among services is vulnerable.

The CVSS score is 6.5, indicating moderate severity, with no EPSS score available and no presence in the CISA KEV catalog. The likely attack vector requires authenticated access to the upload endpoint; once a crafted compressed file is uploaded, the platform experiences rapid resource exhaustion that can be repeatedly triggered by any compromised or malicious user.