CVE-2026-77755— MISP MISP-STIX 资源管理错误漏洞
一分钟漏洞结论
影响对象
misp misp-stix
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
MISP-STIX是MISP组织的一个用于处理 MISP 和 STIX 格式之间转换的 Python 库。 MISP MISP-STIX 2026.7.8及之前版本存在资源管理错误漏洞，该漏洞源于STIX导入代码使用sys.exit()处理解析和加载失败，且未对STIX文档大小进行限制，可能导致畸形文档使进程异常终止，或大型文档消耗过多内存和CPU资源，造成拒绝服务。
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-77755 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library
来源: CVE Program / CVE List V5
Vulnerability Description
A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents.
The STIX import code used sys.exit() to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures bypassed the exception handlers used by callers of the library. As a result, a malformed STIX document could terminate a long-running importer process instead of returning a recoverable parsing error.
Additionally, no limit was imposed on the size of STIX documents before parsing. A submitted document was therefore read and materialised in memory before its validity or type was evaluated. Depending on the document and parsing path, processing could consume approximately two to seven times the input size in memory, allowing a sufficiently large STIX document to cause excessive memory and CPU consumption and potentially terminate or severely degrade the importing service.
An attacker able to provide STIX content to a MISP-STIX import workflow could exploit either condition to affect availability. A malformed document could cause abnormal process termination through an uncaught SystemExit, while a large document could exhaust resources during deserialisation and conversion.
The fixes replace process-terminating sys.exit() calls with catchable exceptions such as STIXLoadingError and MissingSTIXContentError, and extend exception handling around the complete STIX detection and conversion process. The importer also now enforces an input-size limit before parsing. The default maximum is 100 MB, can be adjusted by callers, and can explicitly be disabled when required. STIX 1 inputs are additionally checked for the expected root element before the complete XML tree is constructed.
ImpactSuccessful exploitation can cause:
* termination of a long-running MISP-STIX importer;
* excessive memory allocation;
* excessive CPU consumption;
* degradation or temporary unavailability of services relying on the converter;
* interruption of batch or automated STIX ingestion workflows.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
来源: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
来源: CVE Program / CVE List V5
Vulnerability Title
MISP MISP-STIX 资源管理错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
MISP-STIX是MISP组织的一个用于处理 MISP 和 STIX 格式之间转换的 Python 库。 MISP MISP-STIX 2026.7.8及之前版本存在资源管理错误漏洞，该漏洞源于STIX导入代码使用sys.exit()处理解析和加载失败，且未对STIX文档大小进行限制，可能导致畸形文档使进程异常终止，或大型文档消耗过多内存和CPU资源，造成拒绝服务。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-77755 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
已实测靶场
高级
已在真实靶场复现成功
· 下方是搭建环境并实际触发漏洞的真实录像。
claude_code
· 4385 chars
Pro+ 专属包含：
漏洞复现靶场录像（真实沙箱构建 + 触发，独家）
漏洞原理深度分析
触发条件与影响面
完整可执行 POC 代码
利用链与缓解建议
POC 打包下载
每月 100+ 条 AI 生成额度
三、漏洞 CVE-2026-77755 的情报信息
请登录查看更多情报信息。
CVE-2026-77755 补丁与修复 (2)
同批安全公告 · misp · 2026-08-21 · 共 4 条
| CVE-2026-77751 | 8.8 HIGH | MISP MISP-STIX 路径遍历漏洞 |
| CVE-2026-77710 | 6.9 MEDIUM | MISP MISP-STIX 输入验证错误漏洞 |
| CVE-2026-77761 | 6.3 MEDIUM | MISP MISP-STIX 资源管理错误漏洞 |