The vulnerability originates from the JSON ingestion mapper compiling user‑supplied regular expressions with the JavaScript RegExp engine without validating complexity. An authenticated user with JSON mapper creation permission can provide a pattern that causes catastrophic backtracking against matching input, which exhausts the Node.js event loop and blocks the GraphQL API for all users. The flaw is a classic Regular Expression Denial of Service (CWE‑1333) combined with general resource‑exhaustion weakness (CWE‑400). No data confidentiality or integrity impact is reported.

OpenCTI Platform versions prior to 7.260706.0 are affected. The flaw exists in the JSON ingestion mapper implementation within opencti‑platform/opencti’s GraphQL layer, affecting any system where users can create JSON mappers and run scheduled ingestions.

The CVSS score of 7.1 indicates moderate severity. The EPSS score of 0.00466 indicates a very low likelihood of exploitation, amounting to less than 1% probability. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated access with mapper‑creation rights, which limits public threat actors but permits internal users or compromised accounts to trigger denial of service. Scheduled ingestion jobs can repeatedly execute the malicious mapper without further attacker input, potentially causing persistent outages until the mapper is disabled and the process restarted.