Log in / Sign up

Vulnerability details

CVE-2026-69079

MISP cti-transmute

Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

CVSS 4.0
8.7High

Official description

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

CVSS scores

ScoreVersionSourceVector
8.7High 4.0 CVEProject cvelistV5 (CNA) (CIRCL) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
MISP cti-transmute v ≤ 1.4.0 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-08-03
Last updated
2026-08-03
State
Published
Assigner (CNA)
CIRCL

Exploit prediction (EPSS)

0.54%
Probability of exploitation in 30 days
45.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-770
    Allocation of Resources Without Limits or Throttling