Denial-of-Service Vulnerability in MISP-STIX Affecting Data Processing

CVE-2026-77755

What is CVE-2026-77755?

A vulnerability in MISP-STIX allows attackers to exploit improperly handled STIX documents, leading to potential service disruptions. When malformed or excessively large STIX documents are processed, they can cause abnormal terminations of importer processes or consume excessive memory and CPU resources. This situation can degrade performance and temporarily render services unavailable. The vulnerability arises from the use of sys.exit() in the STIX import code, which bypasses conventional exception handling, allowing attackers to craft documents that overwhelm system resources or disrupt automated workflows. Updates have been implemented to replace the termination calls with manageable exceptions and introduce input-size limits to mitigate impact.

References