CVE-2026-77755: CWE-400 Uncontrolled Resource Consumption in misp misp-stix

The vulnerability in misp-stix involves the use of sys.exit() to handle parsing and loading failures of STIX documents, which raises SystemExit exceptions that bypass normal exception handlers, causing the termination of long-running importer processes. Additionally, the importer does not impose size limits on STIX documents before parsing, allowing large inputs to consume excessive memory and CPU resources. An attacker providing crafted STIX content can exploit these issues to cause denial of service by either abnormal process termination or resource exhaustion. The fixes replace sys.exit() calls with catchable exceptions and enforce a default 100 MB input size limit, which is configurable or can be disabled if necessary. STIX 1 inputs are also validated for expected root elements before full XML parsing.

Successful exploitation can cause termination of the MISP-STIX importer process, excessive memory allocation, excessive CPU consumption, degradation or temporary unavailability of services relying on the importer, and interruption of batch or automated STIX ingestion workflows. This impacts availability but does not affect confidentiality or integrity.

A fix is available that replaces sys.exit() calls with catchable exceptions and enforces an input size limit (default 100 MB) before parsing STIX documents. Users should upgrade to a version later than 2026.7.8 where these fixes are applied. If upgrading is not immediately possible, consider restricting input sizes and validating STIX documents before import to mitigate resource exhaustion and process termination risks.