CVE-2026-76821

OpenCTI versions prior to 7.260706.0 contain a regular expression denial of service (ReDoS) flaw in the JSON ingestion mapper's extractWithRegexp function, which compiles user-supplied patterns with the JavaScript RegExp engine without validating their complexity. An authenticated user holding JSON mapper creation permission can supply a catastrophically backtracking regex together with matching ingestion input, blocking the Node.js event loop and making the GraphQL API unavailable to all users of the instance. Scheduled ingestion can re-execute the malicious mapper repeatedly without further attacker action, and recovery may require disabling the mapper and restarting the process. The impact is limited to availability — no data is exposed or modified — and the flaw is fixed in version 7.260706.0. No public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade OpenCTI to version 7.260706.0 or later. Until patched, restrict JSON mapper creation permissions to trusted analysts and audit existing custom mappers for regexes with nested or overlapping quantifiers that could backtrack. If an instance hangs, identify and disable the offending mapper and restart the process to restore the GraphQL API.