CVE-2026-77755

Name of the Vulnerable Software and Affected Versions misp-stix (affected versions not specified)

Description A denial-of-service issue exists when processing attacker-controlled STIX 1 or STIX 2 documents. The import code utilizes sys.exit() to handle parsing and loading failures; since SystemExit inherits from BaseException rather than Exception, these failures bypass standard exception handlers, allowing a malformed document to terminate the importer process. Furthermore, the lack of input-size limits allows documents to be materialized in memory before validation, potentially consuming two to seven times the input size in memory. This can lead to excessive CPU and memory consumption, resulting in service degradation, abnormal process termination, or the interruption of automated ingestion workflows.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.