Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76821— OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

Quick assessment

Affected
OpenCTI-Platform opencti
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenCTI 是一个用于管理网络威胁情报知识和可观察项的开源平台。在 7.260706.0 之前，JSON 摄入映射器（ingestion mapper）中的 公式函数在 中使用 JavaScript RegExp 引擎编译用户提供的正则表达式时，未对其复杂度进行校验。拥有 JSON 映射器创建权限的已认证用户可以提供一个会导致灾难性回溯（catastrophic backtracking）的正则表达式模式以及匹配的摄入输入数据，从而阻塞 Node.js 事件循环，导致所有用户的 GraphQL API 不可用。

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenCTI-Platform opencti < 7.260706.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76821

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper
Source: CVE Program / CVE List V5
Vulnerability Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in opencti-platform/opencti-graphql/src/parser/json-mapper.ts without validating its complexity. An authenticated user with JSON mapper creation permission could provide a catastrophically backtracking pattern and matching ingestion input, blocking the Node.js event loop and making the GraphQL API unavailable to all users. Scheduled ingestion could repeatedly execute the malicious mapper without additional attacker action, and recovery could require disabling the mapper and restarting the process. The issue affects availability and does not expose or modify data. This issue is fixed in version 7.260706.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenCTI-Platform opencti < 7.260706.0 -

II. Public POCs for CVE-2026-76821

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76821

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76821 (2)

Vendor Advisories for CVE-2026-76821 (1)

Other References for CVE-2026-76821 (1)

IV. Related Vulnerabilities

Same product: opencti
Same vendor: OpenCTI-Platform
Same weakness: CWE-400

V. Comments for CVE-2026-76821

No comments yet

Leave a comment