Is there a patch available for CVE-2026-9137?

Yes, a patch is available for CVE-2026-9137. Update the affected software to the latest version immediately.

MISP CVE-2026-9137

Q: What is the CVSS score of CVE-2026-9137?

CVE-2026-9137 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31155 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-20 CIRCL

GHSA-gfvj-j222-m85v

Denial Of Service Misp

5.1

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:06 vuln.today

Analysis Generated

May 20, 2026 - 20:06 vuln.today

DescriptionCVE.org

The CSP report endpoint intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource exhaustion or log flooding.

AnalysisAI

MISP's CSP report endpoint in versions 2.5.0 through 2.5.37 accepts payloads up to 1 MB per report instead of the developer-intended 1 KB limit, due to a 1,024x magnitude error in the truncation guard (1024 * 1024 instead of 1024). On deployments where the endpoint is reachable by untrusted clients, unauthenticated remote parties (per CVSS PR:N) can abuse this discrepancy to flood application logs with oversized reports, contributing to disk exhaustion or log integrity degradation. No public exploit code exists and active exploitation has not been confirmed; the CVSS 4.0 score of 5.1 (Low-Medium) reflects the limited, availability-only impact.

Technical ContextAI

MISP (Malware Information Sharing Platform) is an open-source threat intelligence sharing platform written in PHP using the CakePHP framework. The vulnerable code resides in app/Controller/ServersController.php within the cspReport() method, which receives Content Security Policy violation reports from browsers. CWE-400 (Uncontrolled Resource Consumption) describes the root cause: the truncation condition used strlen($report) > 1024 * 1024 (evaluating to 1,048,576 bytes / 1 MB) while the inline comment correctly stated the intent was to limit reports to 1 KB (1024 bytes). This 1,024x discrepancy means each logged CSP report could consume up to 1 MB of log space rather than the intended 1 KB. The affected CPE is cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covering the version range 2.5.0 through 2.5.37.

RemediationAI

The upstream fix is available via GitHub commit 02932cccab230b295afcaf5aa05e363d30db0ec9, which corrects the truncation guard from strlen($report) > 1024 * 1024 to strlen($report) > 1024. This fix was reported as 'patch available from vendor' per the source intelligence, but a specific tagged release version incorporating this commit has not been independently confirmed from the available data - operators should verify against the MISP release changelog or ENISA EUVD-2026-31155. As a compensating control where patching is not immediately possible, network-level access controls should be applied to restrict who can POST to the /servers/cspReport endpoint, limiting it to known browser clients or internal networks only - this directly addresses the 'reachable by untrusted clients' prerequisite. Additionally, log rotation policies with size caps can reduce the blast radius of log flooding. Monitoring for unusually large POST bodies to this endpoint can serve as a detection signal.