The vulnerability lies in the archive extraction routine of Malcolm, which allows an attacker to craft a malicious archive with an extremely high number of entries. When processed by the safe-extract.py script, the extraction proceeds without enforcing limits on entry count, directory depth, or total uncompressed size. As a result, the container hosting the filebeat pipeline attempts to create an unlimited number of filesystem objects, consuming almost all available inodes. This uncontrolled resource consumption can disrupt the traffic analysis service and any other application sharing the same filesystem, effectively causing a denial of service. The weakness corresponds to CWE‑770, uncontrolled resource consumption.

The affected product is Malcolm, the network traffic analyst suite developed by cisagov. Any deployment that uses a version older than 26.07.0 is vulnerable, as earlier releases do not impose limits during archive extraction. Users of Malcolm on all supported platforms, regardless of environment, must verify their version and apply the update if they have not yet upgraded.

With a CVSS base score of 6.5, this vulnerability poses moderate risk. The EPSS value is less than 1 %, suggesting that exploitation is unlikely but possible, especially in scenarios where the analyst environment receives user‑supplied archives. The vulnerability is not listed in CISA’s KEV catalog, but it remains present in the open‑source code base. An attacker would need to supply a specially crafted archive to the malicious endpoint, typically via the ingestion API or plugin that accepts files, and the attack can be launched from any system that has write access to the shared file mount. Once the extraction process saturates the inode supply, the filebeat pipeline stops processing new data, and the entire traffic analysis workflow can fail until the mount is cleaned or the system is restarted.