Vulnerability · Published Aug 3, 2026 · Assigned by CIRCL
CVE-2026-69079Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
High 8.7
In plain English
A high-severity resource allocation without limits in cti-transmute from misp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| misp | cti-transmute | 0 – through 1.4.0 |
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N