CVE-2026-85239: MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.
The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.
When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.
Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.
The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and cause a persistent denial of service against event-template functionality for other users.
The patch enforces that event template definitions must be supplied as structured objects before saving and always applies semantic validation. On retrieval, malformed JSON and definitions that do not decode to the expected structure are caught, logged, and replaced with an empty definition, preventing a malformed database entry from breaking all event template queries.
Poisoning doesn't seem reachable according to the lead developer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Patch MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service - Configuration
Apply the patch so event template definitions must be supplied as structured objects before saving, and so semantic validation is always applied (not only when the supplied definition is already represented as an array).
MISP EventTemplate::beforeValidate() event template definition input type enforcement = structured objects
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected by the resulting outage?
Exploitation requires an authenticated user who has permission to create or modify event templates. The resulting failures can affect all authenticated users because the event template index is available to them, as well as other functionality that relies on EventTemplate queries.
What input is needed to trigger the persistent denial of service?
The attacker must submit the template definition as a pre-encoded string rather than an array. Malformed JSON, or JSON that represents an unexpected data type, can bypass semantic validation as long as it satisfies the generic notBlank check.
How can teams determine whether they are already affected?
Look for stored event template definitions containing invalid JSON and for HTTP 500 errors when retrieving the event template listing or other functionality that queries event templates. Retrieval can fail when EventTemplate::afterFind() attempts to decode an invalid stored definition.
What can be done if patching is not immediately possible?
Identify and remove or correct the offending event-template database row so its definition is valid JSON. Restrict create and modify permissions for event templates to trusted authenticated users until the issue is addressed.