CVE-2026-77761

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained per-document state that was not completely cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information, including custom galaxy clusters, could survive a parser reset and subsequently be associated with objects from another bundle. The STIX 1 parsers were affected by the same underlying state-management issue. Depending on the parser type, retained information could include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps. As a result, parsing a second STIX package with an already-used parser could produce a MISP event containing information that was present only in the previously processed package. For example, a generated event could inherit passive DNS records from an earlier document, reference unrelated galaxy information, combine titles from different packages, or use timestamps originating from another conversion. The issue primarily affects applications using the misp-stix API directly and reusing parser instances across independent STIX documents. Normal conversion entry points that instantiate a new parser for each file are not affected by this particular reuse scenario. An attacker able to influence documents processed by such a long-lived parser could potentially cause information from one conversion to contaminate a subsequent MISP event. This can affect the integrity of generated threat intelligence, resulting in incorrect associations, misleading contextual information, or unrelated indicators being attributed to an event. In environments where consecutive documents have different access controls or distribution scopes, the retained state could additionally result in limited disclosure of information from a previously processed document. Successful exploitation depends on the consuming application reusing the same parser instance and on the ordering of processed documents, which increases attack complexity. No direct availability impact or code execution is involved.

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained per-document state that was not completely cleared between conversions. In the STIX 2 parser, galaxy and galaxy-cluster information, including custom galaxy clusters, could survive a parser reset and subsequently be associated with objects from another bundle. The STIX 1 parsers were affected by the same underlying state-management issue. Depending on the parser type, retained information could include galaxies, references, passive DNS bookkeeping, package titles, dates, and timestamps. As a result, parsing a second STIX package with an already-used parser could produce a MISP event containing information that was present only in the previously processed package. For example, a generated event could inherit passive DNS records from an earlier document, reference unrelated galaxy information, combine titles from different packages, or use timestamps originating from another conversion. The issue primarily affects applications using the misp-stix API directly and reusing parser instances across independent STIX documents. Normal conversion entry points that instantiate a new parser for each file are not affected by this particular reuse scenario. An attacker able to influence documents processed by such a long-lived parser could potentially cause information from one conversion to contaminate a subsequent MISP event. This can affect the integrity of generated threat intelligence, resulting in incorrect associations, misleading contextual information, or unrelated indicators being attributed to an event. In environments where consecutive documents have different access controls or distribution scopes, the retained state could additionally result in limited disclosure of information from a previously processed document. Successful exploitation depends on the consuming application reusing the same parser instance and on the ordering of processed documents, which increases attack complexity. No direct availability impact or code execution is involved.

Una vulnerabilidad de aislamiento de estado del analizador en misp-stix podría causar que datos de un documento STIX procesado previamente se retengan y se incorporen al evento MISP generado a partir de un documento subsiguiente cuando se reutiliza la misma instancia del analizador. Varios componentes del analizador STIX 1 y STIX 2 mantenían un estado por documento que no se borraba completamente entre conversiones. En el analizador STIX 2, la información de galaxias y clústeres de galaxias, incluyendo clústeres de galaxias personalizados, podría sobrevivir a un reinicio del analizador y posteriormente asociarse con objetos de otro paquete. Los analizadores STIX 1 se vieron afectados por el mismo problema subyacente de gestión de estado. Dependiendo del tipo de analizador, la información retenida podría incluir galaxias, referencias, contabilidad de DNS pasivo, títulos de paquetes, fechas y marcas de tiempo. Como resultado, analizar un segundo paquete STIX con un analizador ya utilizado podría producir un evento MISP que contenga información que solo estaba presente en el paquete procesado previamente. Por ejemplo, un evento generado podría heredar registros DNS pasivos de un documento anterior, hacer referencia a información de galaxias no relacionada, combinar títulos de diferentes paquetes o usar marcas de tiempo originadas en otra conversión. El problema afecta principalmente a las aplicaciones que utilizan la API de misp-stix directamente y reutilizan instancias del analizador entre documentos STIX independientes. Los puntos de entrada de conversión normales que instancian un nuevo analizador para cada archivo no se ven afectados por este escenario de reutilización particular. Un atacante capaz de influir en los documentos procesados por un analizador de tan larga duración podría potencialmente causar que información de una conversión contamine un evento MISP subsiguiente. Esto puede afectar la integridad de la inteligencia de amenazas generada, lo que resulta en asociaciones incorrectas, información contextual engañosa o indicadores no relacionados que se atribuyen a un evento. En entornos donde los documentos consecutivos tienen diferentes controles de acceso o alcances de distribución, el estado retenido podría adicionalmente resultar en una divulgación limitada de información de un documento procesado previamente. La explotación exitosa depende de que la aplicación consumidora reutilice la misma instancia del analizador y del orden de los documentos procesados, lo que aumenta la complejidad del ataque. No hay un impacto directo en la disponibilidad ni ejecución de código involucrada.