CVE-2026-69079 Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
Unauthenticated attackers can cause denial of service in CTI-Transmute by submitting large values to the activity timeline endpoint, exhausting server resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-69079?
CVE-2026-69079 is a high-severity denial of service vulnerability in misp cti-transmute, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range.
A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website.
The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
Weakness: CWE-770
Which versions are affected by CVE-2026-69079?
How do I fix CVE-2026-69079?
No fix has been published for CVE-2026-69079 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-69079 being exploited?
There is no known exploitation of CVE-2026-69079 in the wild and no public exploit code.
Sources
Also known as GHSA-f6wp-5996-q84w.