CISA Warns of Multiple Vulnerabilities in Malcolm Network Traffic Analysis Tool Suite
The Cybersecurity and Infrastructure Security Agency (CISA) has identified multiple vulnerabilities in the Malcolm network traffic analysis tool suite. These vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. CISA rec…
Intelligence analysis by Llama
CISA has identified multiple vulnerabilities in the Malcolm network traffic analysis tool suite, which could allow an attacker to cause a denial-of-service condition or execute arbitrary code. Users are advised to update to version 26.07.0 or later to address these issues.
Imagine you're at a big party and someone is trying to crash the party by sending too many people at once. The Malcolm tool helps keep the party safe by analyzing the traffic. But, there's a problem with the tool that could let someone crash the party. CISA is warning people to update the tool to fix the problem.
Analysis
Background
The Cybersecurity and Infrastructure Security Agency (CISA) has identified multiple vulnerabilities in the Malcolm network traffic analysis tool suite. These vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. CISA recommends that users update to version 26.07.0 or later to address these issues.
Affected Products
The following versions of CISA Malcolm are affected:
- Malcolm <26.06.1 (CVE-2026-55676)
- Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)
- Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671)
Remediations
Vendor fix Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043.
Relevant CWE
CWE-770 Allocation of Resources Without Limits or Throttling CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434 Unrestricted Upload of File with Dangerous Type
Metrics
CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L 4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Key points
- CISA has identified multiple vulnerabilities in the Malcolm network traffic analysis tool suite.
- These vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.
- Users are advised to update to version 26.07.0 or later to address these issues.
- The vulnerabilities affect the following versions of CISA Malcolm:
- Malcolm <26.06.1 (CVE-2026-55676)
- Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)
- Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671)
If users update to version 26.07.0 or later, they can address the vulnerabilities and prevent potential disruptions or data breaches. This update will help ensure the continued security and reliability of the Malcolm network traffic analysis tool suite.
If users fail to update to version 26.07.0 or later, they may be left vulnerable to attacks that could cause a denial-of-service condition or execute arbitrary code. This could lead to significant disruptions or data breaches, potentially causing long-term damage to their systems and data.
