CVE-2026-69079 Details
Description
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
A vulnerability allowing uncontrolled resource consumption has been identified in CTI-Transmute, specifically within the unauthenticated activity timeline endpoint. The issue arises because the endpoint accepts a user-controlled 'days' query parameter without proper restrictions, allowing remote, unauthenticated attackers to submit excessively large values. This could lead to the application retrieving and processing activity data over arbitrarily long periods, consuming excessive database, CPU, or memory resources. Such resource depletion could delay the handling of concurrent requests or trigger internal server errors. Repeated exploitation could further disrupt the availability of the CTI-Transmute website.
The vulnerability has been addressed by restricting the 'days' parameter to a minimum of one day and a maximum of 1,095 days.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP CTI-Transmute | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | CIRCL |