CVE-2026-9137CWE-400

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

Medium · published May 20, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-05-20T18:43Z
EPSS history
Timeline
  • 20 MAY 18:43Z
    CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
    cvelistv5