Executive brief
A vulnerability in the MISP threat intelligence platform allows remote users to send excessively large security reports to the server. This can lead to the server's logs filling up rapidly, potentially causing system slowdowns or exhausting storage space. Organizations using MISP should apply the available patch to ensure their logging systems remain stable and available.
Technical details
A resource consumption vulnerability exists in the MISP ServersController.php component due to an incorrect size validation check in the cspReport() function. The code intended to limit Content Security Policy (CSP) reports to 1 KB but used a threshold of 1024 * 1024 bytes (1 MB) instead. An unauthenticated remote attacker can exploit this by sending large CSP reports, leading to excessive log volume and potential disk space exhaustion or service degradation. The issue has been addressed in commit 02932cccab230b295afcaf5aa05e363d30db0ec9 by correcting the length check and truncation logic to 1024 bytes.
Affected products
- MISP MISP Prior to commit 02932cccab230b295afcaf5aa05e363d30db0ec9
Timeline
- 2026-05-20: disclosed
- 2026-05-20: patched: Fix committed to MISP repository
- 2026-05-20: advisory