CVE-2026-9137 - CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit · CoreCVE

Back Back to CVE browser

MEDIUM

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

Published May 20, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.

Affected products

Vendor Misp Product Misp Default
unaffected
- Version
  2.5.0
  Status
  affected
  Constraints
  <=2.5.37

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
2.5.0	affected	<=2.5.37

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31155		Advisory
https://github.com/MISP/MISP/commit/02932cccab230b295afcaf5aa05e363d30db0ec9		patch

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CIRCL

Published May 20, 2026

Updated May 29, 2026

Reserved May 20, 2026

Link CVE-2026-9137

CISA Vulnrichment

Updated May 20, 2026

Status Analyzed

Modified Jul 23, 2026

Link CVE-2026-9137

Severity n/a

Public date n/a

Links CVE-2026-9137

Assigner CIRCL

Published May 20, 2026

Updated May 29, 2026

Exploited since n/a

Link EUVD-2026-31155

EUVD-2026-31155