Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77761— Cross-Document Parser State Contamination in misp-stix

Quick assessment

Affected
misp misp-stix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 在 misp-stix 中存在一个解析器状态隔离漏洞。当复用同一个解析器实例处理后续文档时，此前已处理的 STIX 文档中的数据可能被保留并错误地合并到新生成的 MISP 事件中。 多个 STIX 1 和 STIX 2 的解析组件在转换之间未完全清除每文档（per-document）状态。在 STIX 2 解析器中，星系（galaxy）和星系簇（galaxy-cluster）信息（包括自定义星系簇）可能在解析器重置后依然存在，并随后与来自其他束（bundle）的对象关联。 STIX

CVSS 6.3 · Medium EPSS 0.37% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
misp misp-stix ≤ 2026.7.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77761

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-Document Parser State Contamination in misp-stix
Source: CVE Program / CVE List V5
Vulnerability Description
A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained per-document state that was not completely cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information, including custom galaxy clusters, could survive a parser reset and subsequently be associated with objects from another bundle. The STIX 1 parsers were affected by the same underlying state-management issue. Depending on the parser type, retained information could include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps. As a result, parsing a second STIX package with an already-used parser could produce a MISP event containing information that was present only in the previously processed package. For example, a generated event could inherit passive DNS records from an earlier document, reference unrelated galaxy information, combine titles from different packages, or use timestamps originating from another conversion. The issue primarily affects applications using the misp-stix API directly and reusing parser instances across independent STIX documents. Normal conversion entry points that instantiate a new parser for each file are not affected by this particular reuse scenario. An attacker able to influence documents processed by such a long-lived parser could potentially cause information from one conversion to contaminate a subsequent MISP event. This can affect the integrity of generated threat intelligence, resulting in incorrect associations, misleading contextual information, or unrelated indicators being attributed to an event. In environments where consecutive documents have different access controls or distribution scopes, the retained state could additionally result in limited disclosure of information from a previously processed document. Successful exploitation depends on the consuming application reusing the same parser instance and on the ordering of processed documents, which increases attack complexity. No direct availability impact or code execution is involved.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp misp-stix 0 ~ 2026.7.8 -

II. Public POCs for CVE-2026-77761

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77761

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77761 (3)

Same Patch Batch · misp · 2026-08-21 · 4 CVEs total

CVE-2026-77751 8.8 HIGH Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-st
CVE-2026-77755 8.7 HIGH Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-st
CVE-2026-77710 6.9 MEDIUM STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Inje

IV. Related Vulnerabilities

Same product: misp-stix
Same vendor: misp
Same weakness: CWE-459

V. Comments for CVE-2026-77761

No comments yet

Leave a comment