Executive brief
MISP-STIX is a parser library that converts threat intelligence data formats (STIX documents) into MISP events used by security teams. A flaw in how the parser clears its internal state between conversions could cause data from one threat document to "bleed" into the next if the same parser instance is reused, potentially mixing unrelated indicators, galaxy references, and timestamps across different events. This affects data integrity and could cause security teams to make incorrect threat analysis decisions based on contaminated intelligence.
Technical details
This is a state isolation/initialization vulnerability in the STIX 1 and STIX 2 parser components of misp-stix. Per-document state (galaxies, galaxy-clusters, passive DNS records, package titles, dates, timestamps, and references) is not fully cleared between parser resets, allowing retained information to survive and be associated with objects from a subsequent STIX bundle. The vulnerability requires an attacker to influence both the first and second document processed by a reused parser instance. Attack surface is limited to applications that directly use the misp-stix API and reuse parser instances across independent documents; normal conversion entry points that instantiate a new parser per file are unaffected. Exploitation results in data contamination—incorrect associations, misleading context, and information disclosure across documents with different access controls—but does not cause availability impact or code execution. Patches are expected from the maintainers.
Affected products
- MISP misp-stix
Timeline
- 2026-08-21: disclosed