CVE-2026-9137: CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce truncation of CSP reports at 1 KB on the CSP report endpoint (ensure the endpoint limits logged report size to 1 KB rather than allowing up to 1 MB).
MISP CSP report endpoint CSP report size limit = 1 KB - Compensating control
Restrict access to the CSP report endpoint to trusted clients (for example via firewall rules, network ACLs, or WAF) or otherwise remove public/untrusted exposure to prevent untrusted clients from submitting large volumes of reports.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9137?
CVE-2026-9137 has a medium severity score of 5.1 based on the CVSS v3.1 metrics.
How do I fix CVE-2026-9137?
To fix CVE-2026-9137, apply the available patch from the MISP project.
What is the impact of CVE-2026-9137?
CVE-2026-9137 could allow attackers to flood logs with excessive data, potentially leading to resource exhaustion.
What software is affected by CVE-2026-9137?
CVE-2026-9137 affects the MISP Project's MISP software.
When was CVE-2026-9137 published?
CVE-2026-9137 was published on May 20, 2026.