PT-2026-79353 · Misp-Stix · Misp-Stix
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
misp-stix (affected versions not specified)
Description
A denial-of-service issue exists when processing attacker-controlled STIX 1 or STIX 2 documents. The import code utilizes
sys.exit() to handle parsing and loading failures; since SystemExit inherits from BaseException rather than Exception, these failures bypass standard exception handlers, allowing a malformed document to terminate the importer process. Furthermore, the lack of input-size limits allows documents to be materialized in memory before validation, potentially consuming two to seven times the input size in memory. This can lead to excessive CPU and memory consumption, resulting in service degradation, abnormal process termination, or the interruption of automated ingestion workflows.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Misp-Stix