CVE-2026-9137
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. In deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume.
Risk Assessment
This could lead to resource exhaustion or log flooding, making it difficult to monitor and analyze events in the system.
Recommendation
It is recommended to restrict access to the CSP report endpoint only to trusted clients and to verify and improve the report size limit.
Original NVD description (English source)
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.