CVE-2026-9137 — CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

CVE-2026-9137

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit PUBLISHED

Description (CNA)

The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.

Affected (CNA)

Vendor / product	Versions
misp / misp	affected 2.5.0 through 2.5.37

CWE

CWE-400

References

https://github.com/MISP/MISP/commit/02932cccab230b295afcaf5aa05e363d30db0ec9

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.