Denial of Service Vulnerability in OpenCTI Cyber Threat Intelligence Platform

CVE-2026-76821

What is CVE-2026-76821?

The OpenCTI platform, essential for managing cyber threat intelligence, has a vulnerability in its JSON ingestion mapper. This issue arises from the extractWithRegexp formula function, which allows authenticated users to submit a complex regular expression without validation. Such patterns can lead to catastrophic backtracking, effectively blocking the Node.js event loop and rendering the GraphQL API inaccessible to all users. Moreover, scheduled ingestions could repeatedly execute the compromised mapper autonomously, compounding availability issues. Recovery necessitates disabling the mapper and restarting the service. This vulnerability primarily affects system availability without compromising or altering data integrity, and it has been addressed in version 7.260706.0.

References