A high-severity denial-of-service vulnerability in misp-stix enables unauthenticated attackers to crash the service via malicious STIX document processing.

This vulnerability is classified as an uncontrolled resource consumption flaw (CWE-400). It occurs during the parsing of STIX documents, allowing an unauthenticated remote attacker to trigger excessive resource usage, leading to service disruption.

The CVSS score of 8.7 highlights a significant risk to service availability. Successful exploitation could render the MISP platform inaccessible, interrupting critical threat intelligence sharing and operational security workflows.

Immediate Action: Update the misp-stix component to a version beyond 2026.7.8, as specified in the vendor repository.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory spikes, during STIX file ingestion processes.

Compensating Controls: Implement strict input validation or size limits on incoming STIX documents at the edge of the network or via a Web Application Firewall (WAF) if immediate patching is not possible.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to operational continuity. Administrators should verify their current version of misp-stix and apply the available security updates immediately to prevent potential service degradation.