Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces limits on entry count, nesting depth, and total uncompressed bytes when extracting container archives (zip, tar, rar, 7z) via libarchive. However, these limits are not applied to single-stream compressed formats such as .gz, .bz2, .xz, .lzma, and .lz that are not tar-style archives. An authenticated user with permission to upload PCAP or log files can exploit this by uploading a small, highly compressible file (e.g., a gzip bomb) that decompresses to an unbounded size on disk. This can exhaust the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, causing denial of service and disruption of the Malcolm platform for all users.

The vulnerability allows an authenticated user to cause resource exhaustion by uploading a small compressed file that expands to a very large size on disk. This can fill the shared Docker volume used by critical components of the Malcolm platform, leading to denial of service and disruption of service availability for all users relying on the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and monitor disk usage closely to detect abnormal expansion of uploaded files. Consider implementing additional validation or decompression limits for single-stream compressed files in the upload-processing pipeline.