CVE-2026-77761— misp-stix 跨文档解析器状态污染漏洞
一分钟漏洞结论
影响对象
misp misp-stix
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是该漏洞描述信息的中文翻译： 在 misp-stix 中存在一个解析器状态隔离漏洞。当复用同一个解析器实例处理后续文档时，此前已处理的 STIX 文档中的数据可能被保留并错误地合并到新生成的 MISP 事件中。 多个 STIX 1 和 STIX 2 的解析组件在转换之间未完全清除每文档（per-document）状态。在 STIX 2 解析器中，星系（galaxy）和星系簇（galaxy-cluster）信息（包括自定义星系簇）可能在解析器重置后依然存在，并随后与来自其他束（bundle）的对象关联。 STIX
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-77761 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Cross-Document Parser State Contamination in misp-stix
来源: CVE Program / CVE List V5
Vulnerability Description
A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused.
Several STIX 1 and STIX 2 parser components maintained per-document state that was not completely cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information, including custom galaxy clusters, could survive a parser reset and subsequently be associated with objects from another bundle.
The STIX 1 parsers were affected by the same underlying state-management issue. Depending on the parser type, retained information could include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps. As a result, parsing a second STIX package with an already-used parser could produce a MISP event containing information that was present only in the previously processed package. For example, a generated event could inherit passive DNS records from an earlier document, reference unrelated galaxy information, combine titles from different packages, or use timestamps originating from another conversion.
The issue primarily affects applications using the misp-stix API directly and reusing parser instances across independent STIX documents. Normal conversion entry points that instantiate a new parser for each file are not affected by this particular reuse scenario.
An attacker able to influence documents processed by such a long-lived parser could potentially cause information from one conversion to contaminate a subsequent MISP event. This can affect the integrity of generated threat intelligence, resulting in incorrect associations, misleading contextual information, or unrelated indicators being attributed to an event. In environments where consecutive documents have different access controls or distribution scopes, the retained state could additionally result in limited disclosure of information from a previously processed document.
Successful exploitation depends on the consuming application reusing the same parser instance and on the ordering of processed documents, which increases attack complexity. No direct availability impact or code execution is involved.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-77761 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-77761 的情报信息
请登录查看更多情报信息。
CVE-2026-77761 补丁与修复 (3)
同批安全公告 · misp · 2026-08-21 · 共 4 条
| CVE-2026-77751 | 8.8 HIGH | misp-stix STIX导入导出路径穿越漏洞 |
| CVE-2026-77755 | 8.7 HIGH | MISP-STIX 导入模块因畸形或超大文档导致拒绝服务漏洞 |
| CVE-2026-77710 | 6.9 MEDIUM | misp-stix 库 STIX2 解析混淆致属性元数据注入 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-77761
暂无评论