CVE-2026-77761: misp-stix Parser Information Disclosure

CVE-2026-77761 Overview

CVE-2026-77761 is a parser state isolation vulnerability in misp-stix, the STIX-to-MISP conversion library maintained by the MISP Project. Several STIX 1 and STIX 2 parser components retain per-document state that is not fully cleared between conversions. When a consuming application reuses a parser instance across independent STIX documents, data from one document can be incorporated into the MISP event generated from a subsequent document. Retained state can include galaxies, galaxy clusters, references, passive DNS bookkeeping, package titles, dates, and timestamps. The flaw is tracked under [CWE-459: Incomplete Cleanup].

Critical Impact
Reused parser instances can cross-contaminate MISP events, producing incorrect threat intelligence associations and, in some configurations, limited disclosure of information from a previously processed document with different distribution scope.

Affected Products

misp-stix STIX 2 parser (stix2_to_misp) — galaxy and galaxy-cluster state
misp-stix External STIX 1 parser (external_stix1_to_misp) — passive DNS bookkeeping
misp-stix Internal STIX 1 parser (internal_stix1_to_misp) — package titles, dates, and timestamps

Discovery Timeline

2026-08-21 - CVE-2026-77761 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77761

Vulnerability Analysis

The vulnerability stems from incomplete cleanup of per-document state within long-lived parser instances. The misp-stix library exposes parser classes that maintain intermediate collections during conversion of a STIX document into a MISP event. When the parser is reset between conversions, several of these collections are not cleared. Subsequent parsing operations then merge stale state into the new MISP event.

In the STIX 2 parser, galaxy and galaxy-cluster information — including custom galaxy clusters — can survive a reset and become associated with objects from an unrelated bundle. In the STIX 1 parsers, retained state depends on the parser variant. The external variant carries over passive DNS records, while the internal variant carries over titles, dates, and timestamps. As a result, a second MISP event can inherit passive DNS entries from an earlier document, reference unrelated galaxies, or use timestamps originating from a prior conversion.

Standard command-line conversion entry points instantiate a new parser per file and are not exposed. The vulnerability applies to applications that call the misp-stix API directly and reuse parser instances across documents.

Root Cause

The parser reset routine in stix2_to_misp.py did not clear the _galaxies and _clusters dictionaries, and the _custom_galaxy_cluster feature was absent from the _SDOs cleanup tuple. In external_stix1_to_misp.py and internal_stix1_to_misp.py, private collections such as __dns_objects, __dns_ips, __dates, __timestamps, and __titles were initialized in __init__ but never re-initialized at the start of each parse_stix_package call.

Attack Vector

An attacker able to influence the ordering or content of STIX documents processed by a shared parser instance can cause information from one conversion to leak into the next. Exploitation requires the consuming application to reuse a parser and depends on document ordering, which increases attack complexity. There is no code execution or availability impact.

python

# Patch: stix2_to_misp.py — include custom galaxy clusters in the reset set
 _SDOs = (
-    '_grouping', '_report', '_location', '_marking_definition',
-    '_relationship', '_sighting', '_observable', *_LOADED_FEATURES
+    '_custom_galaxy_cluster', '_grouping', '_report', '_location',
+    '_marking_definition', '_relationship', '_sighting', '_observable',
+    *_LOADED_FEATURES
 )

# Patch: stix2_to_misp.py — clear galaxy and cluster state on reset
         self._parsed_object_refs = set()
         self._creators = set()
         self._analyst_data = defaultdict(list)
+        self._clusters = {}
         self._converter_cache.clear()
+        self._galaxies = {}
         for feature in _SDOs:
             if hasattr(self, feature):
                 delattr(self, feature)

# Patch: internal_stix1_to_misp.py — reset bundle state per package
     def __init__(self):
         super().__init__()
         self._mapping = InternalSTIX1toMISPMapping
-        self.__dates = set()
-        self.__timestamps = set()
-        self.__titles = set()

     def parse_stix_package(self, **kwargs):
+        self._reset_bundle_state()
         self._set_parameters(**kwargs)

Source: MISP/misp-stix commit f6593931 and commit f08373dd

Detection Methods for CVE-2026-77761

Indicators of Compromise

MISP events containing passive DNS records, galaxy clusters, or references that do not appear in the source STIX document.
Events with Timestamp, date, or info fields that match values from a previously converted STIX package rather than the current one.
Custom galaxy clusters attached to objects in a STIX 2 bundle where no such cluster was defined.

Detection Strategies

Audit code paths that import misp_stix_converter.stix2misp classes and reuse parser instances across parse_stix_package calls.
Compare generated MISP event attributes and objects against the source STIX bundle to identify fields with no matching origin.
Diff consecutive events produced by the same worker process for unexpected shared galaxies, clusters, or DNS attributes.

Monitoring Recommendations

Log the parser class, process identifier, and source document identifier for each conversion to correlate cross-document contamination.
Alert on MISP events where distribution or sharing group settings change abruptly compared with the enriched attributes, which may indicate leakage across trust boundaries.

How to Mitigate CVE-2026-77761

Immediate Actions Required

Upgrade misp-stix to the release containing commits ad4f0a65, f08373dd, and f6593931.
Inventory internal tooling that imports misp-stix directly and identify any long-lived parser instances.
Re-run recent conversions produced by shared parser workers to verify event integrity.

Patch Information

The MISP project addressed the flaw across three commits. Commit ad4f0a65 adds _custom_galaxy_cluster to the STIX 2 SDO cleanup set. Commit f6593931 clears _galaxies and _clusters on parser reset. Commit f08373dd introduces _reset_bundle_state() calls at the start of parse_stix_package in both the external and internal STIX 1 parsers.

Workarounds

Instantiate a new parser object per STIX document instead of reusing a single instance across bundles.
Route conversions through the standard misp-stix command-line entry points, which create a fresh parser per file.
Isolate conversion workers per distribution scope so that documents with different access controls are never processed by the same parser lifetime.

bash

# Upgrade misp-stix to a patched release
pip install --upgrade misp-stix

# Verify the installed version includes the fix commits
python -c "import misp_stix_converter, inspect; print(inspect.getsourcefile(misp_stix_converter))"