CVE-2026-86452 is a high severity resource exhaustion flaw in MISP 2.5.45 and earlier. The unauthenticated users/forgot password reset endpoint accepted an email value of any length, then stored it twice per request with no throttle. The fix bounds the input and rate limits requests; check MISP releases for the version that includes it.
What's affected
The record's description says the affected version is 2.5.45 and earlier. The fix is MISP commit d75d899, titled "Bound and throttle the unauthenticated mail endpoints". I did not find a release number for the fix in the pages I read, so check the MISP releases page and your instance's version, and treat anything at or below 2.5.45 as affected until you confirm otherwise.
The record rates this High at 7.5. I found no second score to compare. The commit credits a report from the Scottish Government National Cyber Team. Neither the record nor the commit says the weakness is exploited in the wild, and the CVE is not in CISA KEV.
How to check if you're exposed
Find your MISP version in the web interface, or in the application's VERSION file on the server, and compare it with 2.5.45 and the release notes.
To see whether you carry the fix, check whether the commit d75d899 is in your checkout:
cd /var/www/MISP
git log --oneline | grep d75d899
git branch --contains d75d899
Adjust the path to your install. If you run MISP from a container image, check the image tag and its build date against the MISP release page.
Also review where the instance is reachable. The affected endpoints are unauthenticated by design, since a password reset has to work for a user who cannot log in, so an instance published to the internet is the one most exposed.
What to do now
- Confirm your MISP version and whether the fix commit is present.
- Upgrade to a MISP release that includes commit d75d899, or apply the commit following the project guidance.
- After the upgrade, confirm the new limits: the fix returns HTTP 429 when a per source request budget is exceeded.
- Put a reverse proxy rate limit in front of the instance if it is internet facing.
- Watch disk use and database size on exposed instances for signs of abuse before the patch.
Why it matters
The record lists uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770). The password reset handler took an email string from an anonymous caller, did not check its length or format, wrote it to an audit log entry, and queued a reset job that stored it again. One request, two copies of whatever the caller sent.
Without a limit on size or rate, an anonymous party can fill storage and queues. That is a denial of service by slow accumulation, and it is easy to miss until the disk is full.
The fix is more than a length check. It caps the email at 1024 bytes, validates format before doing any persistent work, adds a per source request budget with 429 responses, adds a 15 minute cooldown for API access request emails, and makes the API access request endpoint POST only with CSRF protection. Threat intelligence platforms hold sensitive sharing data, so keeping the instance available matters.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The affected path is unauthenticated, which is the point of the advisory.
What does the fix change for users?
Overlong or malformed emails are rejected, and heavy request sources receive HTTP 429. A legitimate user who requests several resets in a row may be throttled.
Sources
Last reviewed: 18 October 2026.
