CVE-2026-9137 — CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is r…
Published: 2026-05-20 · CVSS: 5.1 · CVSS 4.0
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7