A denial‑of‑service vulnerability arises when the misp‑stix library processes attacker‑controlled STIX documents. The import code uses sys.exit() for parsing errors, which bypasses the standard exception handling path and can terminate the importer process. Additionally, the library accepts documents of arbitrary size, materializing the entire payload in memory before validation. A malicious actor can therefore send either a malformed or an excessively large STIX file to either crash the service or exhaust its memory and CPU resources.

Systems that embed the misp‑stix library for STIX ingestion—including MISP‑STIX importer services and automated STIX ingestion workflows—are impacted. The vendor misp:misp-stix applies to any deployment that processes incoming STIX 1 or STIX 2 documents. No specific version information is available in the current data, so all releases of the library before the fix are potentially vulnerable.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to submit STIX content to an importer, either through a public endpoint or an internal API. When successful, the attacker can trigger a ProcessExit exception that terminates the importer, or provide a large, valid STIX payload that causes memory exhaustion and excessive CPU usage, resulting in service degradation or downtime.