The vulnerability in MISP allows unauthenticated or weakly constrained requests to perform persistent work without input bounds or rate limiting. Attackers can target the forgot‑password or password‑reset endpoints with arbitrary e‑mail addresses; the system accepts these values without imposing a reasonable length constraint or validating their format, then logs the address and queues a password‑reset job. The submitted value is stored twice per request, resulting in unbounded storage consumption and the potential to flood the service, which can lead to denial of service.

All MISP installations running version 2.5.45 or earlier are affected, regardless of deployment size.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is 0.00306 (indicating a low exploitation probability), and the issue is not listed in CISA KEV. Attackers can exploit the flaw from any remote location without authentication by submitting crafted e‑mail addresses to the vulnerable endpoints. Since the system does not enforce input bounds or throttle, a single malicious actor can flood the service, exhausting disk space or memory. The lack of rate limiting means the attack can be performed continuously until mitigated.