CVE-2026-77755: MISP-STIX DOS Vulnerability

CVE-2026-77755 Overview

CVE-2026-77755 is a denial-of-service vulnerability in the misp-stix library used to convert STIX 1 and STIX 2 documents for MISP (Malware Information Sharing Platform). The library invoked sys.exit() to signal parsing and loading failures. Because SystemExit inherits from BaseException, these exits bypassed caller exception handlers and terminated long-running importer processes. The library also read entire STIX documents into memory before validating them, and parsing could consume roughly two to seven times the input size. An attacker able to submit STIX content to a MISP-STIX import workflow could crash the importer or exhaust host resources [CWE-400].

Critical Impact
A single malformed or oversized STIX document can terminate a long-running importer process or exhaust host memory and CPU, disrupting automated threat intelligence ingestion pipelines.

Affected Products

MISP misp-stix converter library (STIX 1 and STIX 2 import paths)
MISP instances and services that call misp-stix for STIX ingestion
Automated or batch STIX intelligence ingestion workflows built on misp-stix

Discovery Timeline

2026-08-21 - CVE-2026-77755 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77755

Vulnerability Analysis

The flaw combines two independent denial-of-service conditions in the STIX import path. First, several parsing and loading failures were signalled via sys.exit(), which raises SystemExit. Callers wrapping the library in try/except Exception did not catch this, so a malformed document propagated an uncaught exit and terminated the surrounding process. Second, the importer materialised the entire STIX document in memory before evaluating validity or type. Depending on the parsing path, resident memory grew to approximately two to seven times the input size.

An attacker submitting a large or malformed STIX file can therefore either crash the importer or drive it into memory and CPU exhaustion. The impact is scoped to availability. There is no confidentiality or integrity impact and no code execution primitive.

Root Cause

The root cause is improper error handling combined with unbounded resource consumption [CWE-400]. Using sys.exit() inside a library function conflates fatal script behaviour with recoverable parsing errors. The absence of an input-size check meant deserialisation ran before any structural validation.

Attack Vector

Exploitation requires network-reachable submission of attacker-controlled STIX content to a workflow that hands the document to misp-stix. No authentication or user interaction is required when the ingestion endpoint accepts untrusted feeds. The attacker crafts either a malformed document that triggers a sys.exit() code path, or an oversized document that consumes multiples of its size in memory during parsing.

python

# Patch excerpt: misp_stix_converter/__init__.py
import argparse
from .misp2stix import InvalidMISPInputError  # noqa
-from .tools import STIXLoadingError  # noqa
+from .tools import STIXInputSizeError, STIXLoadingError  # noqa
from .misp2stix import MISPtoSTIX1AttributesParser, MISPtoSTIX1EventsParser  # noqa
from .misp2stix import MISPtoSTIX1Mapping  # noqa
from .misp2stix import MISPtoSTIX20Parser, MISPtoSTIX21Parser  # noqa

Source: GitHub MISP STIX Commit e8e732ad. The patch replaces process-terminating sys.exit() calls with catchable exceptions (STIXLoadingError, MissingSTIXContentError) and introduces STIXInputSizeError to enforce an input-size limit before parsing.

Detection Methods for CVE-2026-77755

Indicators of Compromise

Unexpected termination of MISP-STIX importer processes with SystemExit traces in application logs.
Sharp memory growth on importer hosts correlated with a single inbound STIX document.
STIX submissions significantly larger than typical feed payloads, particularly above the 100 MB default limit.
Repeated malformed STIX 1 XML submissions lacking the expected root element.

Detection Strategies

Inspect importer logs for SystemExit propagation or abrupt worker restarts tied to STIX ingestion jobs.
Correlate misp-stix versions in inventory against the patched commits 66119552 and e8e732ad.
Alert on ingestion latency spikes or out-of-memory (OOM) kills on hosts running MISP or STIX converter workers.

Monitoring Recommendations

Track memory and CPU utilisation of MISP worker processes and set thresholds against normal ingestion baselines.
Log the size and source of every submitted STIX document at the ingress layer, before it reaches the converter.
Monitor process supervisor events (systemd, supervisord, container orchestrator) for repeated restarts of importer services.

How to Mitigate CVE-2026-77755

Immediate Actions Required

Upgrade misp-stix to a release containing commits 66119552 and e8e732ad.
Restrict STIX ingestion endpoints to authenticated, trusted feed sources until patched.
Enforce an upstream request-size limit at the reverse proxy or API gateway in front of MISP.

Patch Information

The fixes are applied in two upstream commits: GitHub MISP STIX Commit 66119552 replaces sys.exit() calls with catchable STIXLoadingError and MissingSTIXContentError exceptions and widens exception handling around STIX detection and conversion. GitHub MISP STIX Commit e8e732ad adds an input-size check with a default 100 MB maximum, exposes STIXInputSizeError, and validates the STIX 1 XML root element before building the full tree. The limit is configurable by callers and can be disabled when required.

Workarounds

Cap the maximum accepted payload size for STIX ingestion at the web server or gateway to well below available worker memory.
Run importer workers under a process supervisor with automatic restart and per-process memory limits (for example, cgroups or container memory caps).
Pre-validate STIX 1 submissions for the expected XML root element before forwarding them to the converter.

bash

# Example nginx configuration to cap STIX submission size
http {
    client_max_body_size 100m;

    server {
        location /stix/import {
            client_max_body_size 100m;
            proxy_pass http://misp_backend;
        }
    }
}