CVE-2026-107335

Malcolm's upload pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits for container archives (zip, tar, rar, and 7z via libarchive), but those limits are not applied to single-stream compressed files such as .gz, .bz2, .xz, .lzma, and .lz that are not .tar.* archives. Any authenticated user allowed to upload PCAP or log files can submit a small, highly compressible file that expands to an effectively unbounded size on disk. That expansion can exhaust the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek and disrupt the platform for every user. Impact is availability only (CVSS 3.1 6.5, CWE-409); confidentiality and integrity are not affected. No public proof of concept is known, and the issue is not in CISA KEV.

What to do: Until a fixed Malcolm release is installed, restrict which accounts may upload PCAP or log files and apply the same uncompressed-size cap to single-stream formats (.gz, .bz2, .xz, .lzma, .lz) that container archives already use. Monitor free space on the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and isolate upload processing so one upload cannot fill disk for the whole platform. No patched version is named in the provided data.