Vulnerability-Lookup

FKIE_CVE-2026-77755

Vulnerability from fkie_nvd - Published: 2026-08-21 10:16 - Updated: 2026-10-16 15:10

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Summary

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit() to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures bypassed the exception handlers used by callers of the library. As a result, a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error. Additionally, no limit was imposed on the size of STIX documents before parsing. A submitted document was therefore read and materialised in memory before its validity or type was evaluated. Depending on the document and parsing path, processing could consume approximately two to seven times the input size in memory, allowing a sufficiently large STIX document to cause excessive memory and CPU consumption and potentially terminate or severely degrade the importing service. An attacker able to provide STIX content to a MISP-STIX import workflow could exploit either condition to affect availability. A malformed document could cause abnormal process termination through an uncaught SystemExit, while a large document could exhaust resources during deserialisation and conversion. The fixes replace process-terminating sys.exit() calls with catchable exceptions such as STIXLoadingError and MissingSTIXContentError, and extend exception handling around the complete STIX detection and conversion process. The importer also now enforces an input-size limit before parsing. The default maximum is 100 MB, can be adjusted by callers, and can explicitly be disabled when required. STIX 1 inputs are additionally checked for the expected root element before the complete XML tree is constructed. ImpactSuccessful exploitation can cause: * termination of a long-running MISP-STIX importer; * excessive memory allocation; * excessive CPU consumption; * degradation or temporary unavailability of services relying on the converter; * interruption of batch or automated STIX ingestion workflows.

References

	URL	Tags
	5a6e4751-2f3f-4070-9419-94fb35b644e8	https://github.com/MISP/misp-stix/commit/66119552
	5a6e4751-2f3f-4070-9419-94fb35b644e8	https://github.com/MISP/misp-stix/commit/e8e732ad

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "misp-stix",
          "repo": "https://github.com/MISP/misp-stix/",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2026.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents.\n\nThe STIX import code used sys.exit() to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures bypassed the exception handlers used by callers of the library. As a result, a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error.\n\nAdditionally, no limit was imposed on the size of STIX documents before parsing. A submitted document was therefore read and materialised in memory before its validity or type was evaluated. Depending on the document and parsing path, processing could consume approximately two to seven times the input size in memory, allowing a sufficiently large STIX document to cause excessive memory and CPU consumption and potentially terminate or severely degrade the importing service.\n\nAn attacker able to provide STIX content to a MISP-STIX import workflow could exploit either condition to affect availability. A malformed document could cause abnormal process termination through an uncaught SystemExit, while a large document could exhaust resources during deserialisation and conversion.\n\nThe fixes replace process-terminating sys.exit() calls with catchable exceptions such as STIXLoadingError and MissingSTIXContentError, and extend exception handling around the complete STIX detection and conversion process. The importer also now enforces an input-size limit before parsing. The default maximum is 100 MB, can be adjusted by callers, and can explicitly be disabled when required. STIX 1 inputs are additionally checked for the expected root element before the complete XML tree is constructed.\n\nImpactSuccessful exploitation can cause:\n\n  *  termination of a long-running MISP-STIX importer;\n  *  excessive memory allocation;\n  *  excessive CPU consumption;\n  *  degradation or temporary unavailability of services relying on the converter;\n  *  interruption of batch or automated STIX ingestion workflows."
    },
    {
      "lang": "es",
      "value": "Se identific\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio en misp-stix al procesar documentos STIX 1 o STIX 2 controlados por el atacante.\n\nEl c\u00f3digo de importaci\u00f3n de STIX usaba sys.exit() para manejar varias fallas de an\u00e1lisis y carga. Debido a que SystemExit hereda de BaseException en lugar de Exception, estas fallas eludieron los manejadores de excepciones utilizados por los llamadores de la biblioteca. Como resultado, un documento STIX malformado podr\u00eda terminar un proceso de importaci\u00f3n de larga duraci\u00f3n en lugar de devolver un error de an\u00e1lisis recuperable.\n\nAdem\u00e1s, no se impuso ning\u00fan l\u00edmite al tama\u00f1o de los documentos STIX antes del an\u00e1lisis. Por lo tanto, un documento enviado se le\u00eda y materializaba en memoria antes de que se evaluara su validez o tipo. Dependiendo del documento y la ruta de an\u00e1lisis, el procesamiento podr\u00eda consumir aproximadamente de dos a siete veces el tama\u00f1o de entrada en memoria, permitiendo que un documento STIX suficientemente grande causara un consumo excesivo de memoria y CPU y potencialmente terminara o degradara severamente el servicio de importaci\u00f3n.\n\nUn atacante capaz de proporcionar contenido STIX a un flujo de trabajo de importaci\u00f3n de MISP-STIX podr\u00eda explotar cualquiera de las dos condiciones para afectar la disponibilidad. Un documento malformado podr\u00eda causar la terminaci\u00f3n anormal del proceso a trav\u00e9s de un SystemExit no capturado, mientras que un documento grande podr\u00eda agotar los recursos durante la deserializaci\u00f3n y conversi\u00f3n.\n\nLas correcciones reemplazan las llamadas a sys.exit() que terminan el proceso con excepciones capturables como STIXLoadingError y MissingSTIXContentError, y extienden el manejo de excepciones a todo el proceso de detecci\u00f3n y conversi\u00f3n de STIX. El importador ahora tambi\u00e9n impone un l\u00edmite de tama\u00f1o de entrada antes del an\u00e1lisis. El m\u00e1ximo predeterminado es de 100 MB, puede ser ajustado por los llamadores y puede ser deshabilitado expl\u00edcitamente cuando sea necesario. Las entradas STIX 1 se verifican adicionalmente para el elemento ra\u00edz esperado antes de que se construya el \u00e1rbol XML completo.\n\nImpacto\nLa explotaci\u00f3n exitosa puede causar:\n\n  *  terminaci\u00f3n de un importador MISP-STIX de larga duraci\u00f3n;\n  *  asignaci\u00f3n excesiva de memoria;\n  *  consumo excesivo de CPU;\n  *  degradaci\u00f3n o indisponibilidad temporal de los servicios que dependen del conversor;\n  *  interrupci\u00f3n de los flujos de trabajo de ingesta de STIX por lotes o automatizados."
    }
  ],
  "id": "CVE-2026-77755",
  "lastModified": "2026-10-16T15:10:00.103",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77755",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T12:06:03.611904Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T10:16:39.363",
  "references": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "url": "https://github.com/MISP/misp-stix/commit/66119552"
    },
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "url": "https://github.com/MISP/misp-stix/commit/e8e732ad"
    }
  ],
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary"
    }
  ]
}

CVE-2026-77755 (GCVE-0-2026-77755)

Vulnerability from cvelistv5 – Published: 2026-08-21 09:55 – Updated: 2026-08-21 12:09

Title

Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library

Summary

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 12:06 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 243 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/MISP/misp-stix/commit/e8e732ad	patch
https://github.com/MISP/misp-stix/commit/66119552	patch

Impacted products

1 product

Vendor	Product	Version
misp	misp-stix	Affected: 0 , ≤ 2026.7.8 (semver)

Credits

🕵️‍♂️ Jeroen Pinoy 🐞 Christian Studer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77755",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T12:06:03.611904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T12:09:16.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp-stix",
          "repo": "https://github.com/MISP/misp-stix/",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "2026.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Studer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA denial-of-service vulnerability was identified in \u003cstrong\u003emisp-stix\u003c/strong\u003e when processing attacker-controlled STIX 1 or STIX 2 documents.\u003c/p\u003e\u003cp\u003eThe STIX import code used \u003ccode\u003esys.exit()\u003c/code\u003e to handle several parsing and loading failures. Because \u003ccode\u003eSystemExit\u003c/code\u003e inherits from \u003ccode\u003eBaseException\u003c/code\u003e rather than \u003ccode\u003eException\u003c/code\u003e, these failures bypassed the exception handlers used by callers of the library. As a result, a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error.\u003c/p\u003e\u003cp\u003eAdditionally, no limit was imposed on the size of STIX documents before parsing. A submitted document was therefore read and materialised in memory before its validity or type was evaluated. Depending on the document and parsing path, processing could consume approximately \u003cstrong\u003etwo to seven times the input size in memory\u003c/strong\u003e, allowing a sufficiently large STIX document to cause excessive memory and CPU consumption and potentially terminate or severely degrade the importing service.\u003c/p\u003e\u003cp\u003eAn attacker able to provide STIX content to a MISP-STIX import workflow could exploit either condition to affect availability. A malformed document could cause abnormal process termination through an uncaught \u003ccode\u003eSystemExit\u003c/code\u003e, while a large document could exhaust resources during deserialisation and conversion.\u003c/p\u003e\u003cp\u003eThe fixes replace process-terminating \u003ccode\u003esys.exit()\u003c/code\u003e calls with catchable exceptions such as \u003ccode\u003eSTIXLoadingError\u003c/code\u003e and \u003ccode\u003eMissingSTIXContentError\u003c/code\u003e, and extend exception handling around the complete STIX detection and conversion process. The importer also now enforces an input-size limit before parsing. The default maximum is \u003cstrong\u003e100 MB\u003c/strong\u003e, can be adjusted by callers, and can explicitly be disabled when required. STIX 1 inputs are additionally checked for the expected root element before the complete XML tree is constructed.\u003c/p\u003e\u003ch2\u003eImpact\u003c/h2\u003e\u003cp\u003eSuccessful exploitation can cause:\u003c/p\u003e\u003cul\u003e\u003cli\u003etermination of a long-running MISP-STIX importer;\u003c/li\u003e\u003cli\u003eexcessive memory allocation;\u003c/li\u003e\u003cli\u003eexcessive CPU consumption;\u003c/li\u003e\u003cli\u003edegradation or temporary unavailability of services relying on the converter;\u003c/li\u003e\u003cli\u003einterruption of batch or automated STIX ingestion workflows.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents.\n\nThe STIX import code used sys.exit() to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures bypassed the exception handlers used by callers of the library. As a result, a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error.\n\nAdditionally, no limit was imposed on the size of STIX documents before parsing. A submitted document was therefore read and materialised in memory before its validity or type was evaluated. Depending on the document and parsing path, processing could consume approximately two to seven times the input size in memory, allowing a sufficiently large STIX document to cause excessive memory and CPU consumption and potentially terminate or severely degrade the importing service.\n\nAn attacker able to provide STIX content to a MISP-STIX import workflow could exploit either condition to affect availability. A malformed document could cause abnormal process termination through an uncaught SystemExit, while a large document could exhaust resources during deserialisation and conversion.\n\nThe fixes replace process-terminating sys.exit() calls with catchable exceptions such as STIXLoadingError and MissingSTIXContentError, and extend exception handling around the complete STIX detection and conversion process. The importer also now enforces an input-size limit before parsing. The default maximum is 100 MB, can be adjusted by callers, and can explicitly be disabled when required. STIX 1 inputs are additionally checked for the expected root element before the complete XML tree is constructed.\n\nImpactSuccessful exploitation can cause:\n\n  *  termination of a long-running MISP-STIX importer;\n  *  excessive memory allocation;\n  *  excessive CPU consumption;\n  *  degradation or temporary unavailability of services relying on the converter;\n  *  interruption of batch or automated STIX ingestion workflows."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T09:55:11.079Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-stix/commit/e8e732ad"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-stix/commit/66119552"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-77755",
    "datePublished": "2026-08-21T09:55:11.079Z",
    "dateReserved": "2026-08-21T09:55:04.399Z",
    "dateUpdated": "2026-08-21T12:09:16.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted