Uncontrolled Resource Consumption Vulnerability in CTI-Transmute by MISP

CVE-2026-69079

What is CVE-2026-69079?

CTI-Transmute is affected by an uncontrolled resource consumption vulnerability associated with the unauthenticated /activity_timeline endpoint. This endpoint accepts a user-controlled 'days' parameter, which lacks proper restrictions on its value. Attackers can exploit this flaw by submitting excessively high values, leading to the application processing an unreasonable amount of activity data. As a result, this could heavily tax the backend resources, such as CPU and memory, potentially causing delays in processing other requests or even resulting in internal server errors. To mitigate this issue, a recent patch has been implemented to restrict the requested timeline range to a minimum of one day and a maximum of 1,095 days, ensuring the system remains stable even under potential attack.

References