CVE-2026-77761: CWE-459 Incomplete Cleanup in misp misp-stix

The vulnerability in misp-stix arises from incomplete cleanup of parser state between processing STIX documents. Several STIX 1 and STIX 2 parser components maintain per-document state that is not fully cleared on reuse. In STIX 2, galaxy and galaxy-cluster data, including custom clusters, can persist after a parser reset and be incorrectly associated with objects from a different bundle. STIX 1 parsers similarly retain galaxies, references, passive DNS data, package titles, dates, and timestamps. This causes subsequent MISP events generated by the reused parser to contain data from previously processed documents, potentially contaminating threat intelligence with unrelated or misleading information. The issue primarily affects applications that reuse parser instances via the misp-stix API rather than those that instantiate a new parser per document. Exploitation requires control over the documents processed by a long-lived parser and depends on document ordering.

The vulnerability can compromise the integrity of threat intelligence by causing MISP events to include data from unrelated STIX documents. This may lead to incorrect associations, misleading contextual information, or unrelated indicators being attributed to events. In environments with different access controls or distribution scopes for consecutive documents, there is a risk of limited disclosure of information from previously processed documents. There is no impact on system availability or code execution. Exploitation complexity is increased due to the need for parser reuse and document ordering.

No official patch or fix is currently documented. The vulnerability primarily affects applications that reuse the same parser instance for multiple STIX documents. Mitigation involves ensuring that a new parser instance is created for each STIX document processed, avoiding reuse of parser instances. Users should review their use of the misp-stix API to confirm that parser instances are not reused across independent documents. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.