CVE-2026-77761

Name of the Vulnerable Software and Affected Versions misp-stix (affected versions not specified)

Description A parser state isolation issue exists where data from a previously processed STIX document may be retained and incorporated into a MISP event generated from a subsequent document if the same parser instance is reused. This occurs because several STIX 1 and STIX 2 parser components maintain per-document state that is not fully cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information can survive a parser reset. For STIX 1 parsers, retained data may include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps.

This issue primarily affects applications that use the misp-stix API directly and reuse parser instances across independent STIX documents. An attacker could potentially contaminate subsequent MISP events, compromising the integrity of threat intelligence through incorrect associations or misleading contextual information. In environments with different access controls for consecutive documents, this could lead to limited information disclosure. Exploitation requires the consuming application to reuse the same parser instance and depends on the order of processed documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, ensure that a new parser instance is instantiated for each STIX document instead of reusing a single instance across multiple documents.