CVE-2026-44379 Details
Description
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers. This vulnerability is fixed in 2.5.37.
A vulnerability exists in MISP Collections versions prior to 2.5.37 due to inadequate validation of UUIDs in the uuid field, failing to comply with RFC 4122 standards. This flaw allows users to create or modify Collection records with malformed UUIDs, which could lead to data integrity problems or unpredictable behavior in areas of the code that rely on Collection UUIDs being valid. The issue has been addressed by implementing model-level validation for the uuid field, ensuring that only properly formatted UUIDs are accepted.
Users can upgrade to MISP version 2.5.37 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/f8b20358c3cd8fd3d784452901876f2db0acbf05 | [email protected] | Patch |
| https://github.com/MISP/MISP/security/advisories/GHSA-jrvj-84mg-8f29 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| misp-project misp | < 2.5.37 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |