An improper input validation flaw in Malcolm's upload‑processing pipeline allows highly compressed single‑stream files to bypass defined size limits, leading to data amplification. A small, highly compressible file can expand to an effectively unbounded size on disk, exhausting shared storage used by OpenSearch, Logstash, Arkime, and Zeek. The vulnerability is classified under CWE‑409 and can be leveraged by an authenticated user with upload rights, potentially causing a denial of service for all users.

The issue affects the Malcolm platform distributed by CISAgov. All releases prior to version 26.08.0 lack the necessary checks for single‑stream compressed formats, making those deployments vulnerable regardless of other configuration settings. Version 26.08.0 and later incorporate the fix.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is not available and it is not listed in CISA KEV. An attacker who can authenticate and is permitted to upload PCAP/log files can trigger the data amplification by uploading a small compressed file that expands to a large, unbounded size, depleting the Docker volume and disrupting platform services. The flaw is exploitable over the network via a standard upload action, though it requires valid upload credentials.