CVE-2026-77761 in misp-stix
Summary
by MITRE • 08/21/2026
A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused.
Several STIX 1 and STIX 2 parser components maintained per-document state that was not completely cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information, including custom galaxy clusters, could survive a parser reset and subsequently be associated with objects from another bundle.
The STIX 1 parsers were affected by the same underlying state-management issue. Depending on the parser type, retained information could include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps. As a result, parsing a second STIX package with an already-used parser could produce a MISP event containing information that was present only in the previously processed package. For example, a generated event could inherit passive DNS records from an earlier document, reference unrelated galaxy information, combine titles from different packages, or use timestamps originating from another conversion.
The issue primarily affects applications using the misp-stix API directly and reusing parser instances across independent STIX documents. Normal conversion entry points that instantiate a new parser for each file are not affected by this particular reuse scenario.
An attacker able to influence documents processed by such a long-lived parser could potentially cause information from one conversion to contaminate a subsequent MISP event. This can affect the integrity of generated threat intelligence, resulting in incorrect associations, misleading contextual information, or unrelated indicators being attributed to an event. In environments where consecutive documents have different access controls or distribution scopes, the retained state could additionally result in limited disclosure of information from a previously processed document.
Successful exploitation depends on the consuming application reusing the same parser instance and on the ordering of processed documents, which increases attack complexity. No direct availability impact or code execution is involved.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within the misp-stix library represents a critical state isolation failure in its STIX parsing components, specifically affecting both STIX 1 and STIX 2 parsers. This flaw arises from improper memory management practices where per-document state variables are not fully reset or cleared between consecutive conversion operations when the same parser instance is reused across multiple independent documents. In secure software design, particularly for libraries handling structured data formats like STIX, it is imperative that each parsing operation begins with a clean slate to ensure complete isolation of input contexts. The failure to clear internal state variables allows residual data from previously processed files to persist in memory and inadvertently merge into the output generated by subsequent processing tasks. This behavior violates fundamental principles of secure coding regarding object lifecycle management and context separation, leading to potential cross-document contamination where information intended for one threat intelligence event leaks into another unrelated event.
In the specific case of STIX 2 parsing, the vulnerability allows galaxy and galaxy-cluster metadata, including custom-defined clusters, to survive parser resets and become associated with objects from entirely different bundles. For STIX 1 parsers, a broader range of internal bookkeeping data remains uncleared, including passive DNS records, reference lists, package titles, dates, and timestamps. When an application reuses the same parser instance for multiple conversions, these retained elements are not discarded but rather carried over into the new parsing context. Consequently, if a second STIX document is processed using this persistent parser instance, the resulting MISP event may contain passive DNS records that originated from the first document, reference galaxy information unrelated to the current threat data, combine titles from disparate packages, or utilize timestamps derived from previous conversions rather than those present in the new input. This creates a scenario where the integrity of the generated threat intelligence is compromised by the injection of stale or irrelevant contextual metadata.
The operational impact of this vulnerability centers on the corruption of threat intelligence accuracy and potential information leakage within MISP deployments that implement parser reuse for performance optimization. Applications utilizing the misp-stix API directly with long-lived parser instances are at risk, whereas standard conversion entry points that instantiate a new parser object for each individual file remain unaffected by this specific state retention issue. An attacker who can influence or control the sequence of documents processed by such an application could exploit this flaw to contaminate MISP events with data from unrelated sources. This contamination manifests as incorrect associations between indicators and threat actors, misleading contextual information that obscures the true nature of a campaign, or the attribution of unrelated indicators to specific events. In environments where different STIX packages carry varying access control levels or distribution scopes, this state leakage could also result in limited disclosure violations, allowing sensitive details from one document to appear in an event with lower security clearance than intended.
From a classification perspective, this vulnerability aligns closely with CWE-672, which pertains to the use of operationally critical objects after their expiration or improper resource management, and more specifically reflects aspects of CWE-431 regarding memory reuse without proper initialization or clearing. The attack vector leverages the application's architectural decision to persist parser instances for efficiency, turning a performance optimization into a security liability through state pollution. While this flaw does not provide direct code execution capabilities nor cause immediate availability impacts such as denial of service, it significantly undermines the trustworthiness and integrity of automated threat intelligence sharing platforms. The exploitation complexity is moderate, requiring an attacker to have some degree of influence over the order or content of documents processed by a long-lived parser instance within the target application infrastructure.
Mitigation strategies must focus on enforcing strict state isolation regardless of performance considerations. Developers should ensure that every parsing operation initializes all internal variables and clears any residual data structures before processing new input, even if this necessitates creating fresh parser instances for each document rather than reusing existing ones. If parser reuse is deemed essential for system performance, a robust reset mechanism must be implemented to explicitly nullify or reallocate all state-holding fields including galaxy references, passive DNS caches, and timestamp buffers after every conversion cycle. Additionally, input validation should verify that no unexpected metadata persists in the output event structure compared to the current document's content. Security teams deploying MISP with custom integrations using misp-stix should audit their code for parser instance reuse patterns and apply patches or updates provided by the library maintainers that address this state management deficiency. Regular security reviews of data flow between parsing stages can further help identify similar isolation failures in other components of the threat intelligence pipeline.