CTI-Transmute contains an uncontrolled resource‑consumption flaw in its /activity_timeline endpoint. The endpoint accepts a days parameter that can be set to an arbitrarily large integer, which causes the application to query and process data for an extreme range. This leads to excessive database reads, high CPU and memory usage, and can delay legitimate traffic or raise internal server errors, resulting in a denial of service. The weakness is classified as CWE-770.

The flaw affects any deployment of CTI-Transmute that exposes the /activity_timeline API. No specific version information is provided, so all releases lacking the patch that clamps the days range to between one and 1,095 days are vulnerable.

The CVSS score of 8.7 signals high severity. While a current EPSS score is not available, the vulnerability can be exploited remotely without authentication by sending requests with extreme days values. Because it is not listed in the CISA KEV catalog, there is no public evidence of exploitation yet, but the lack of authentication combined with a high impact makes the risk substantial for publicly accessible instances.