Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver…
Priority MEDIUM 50CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08179 94th percentileScored 2026-11-07
Fix Partial com.thoughtworks.xstream:xstream (Maven): 1.4.9Red Hat: 2 advisoriesRed Hat: 2 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.9 | 1.4.9 | Patch available | GHSA-rgh3-987h-wpmw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.9 Fixed in 1.4.9 Patch available GHSA-rgh3-987h-wpmw
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:* | 1 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* | 22 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* | 23 | Vulnerable | Fedoraproject |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | before 1.4.9 | Vulnerable | XStream |
- cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.9 Vulnerable ·XStream
Remediation
- Fix · GHSA-rgh3-987h-wpmw com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.9 Advisory →
Red Hat 2 advisories
- RHSA-2016:2822 Released 2016-11-28 · Red Hat rating ModerateRed Hat JBoss BPM Suite security update
- Red Hat JBoss BPMS 6.3
- RHSA-2016:2823 Released 2016-11-28 · Red Hat rating ModerateRed Hat JBoss BRMS security update
- Red Hat JBoss BRMS 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Virtualization 3 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Data Grid 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat JBoss BPMS 6.3 | Fixed | RHSA-2016:2822 |
| Red Hat JBoss BRMS 6.3 | Fixed | RHSA-2016:2823 |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3674
- 2026-10-03 Alias added: GHSA-rgh3-987h-wpmw
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 10
- http://x-stream.github.io/changes.html#1.4.9
- FEDORA-2016-de909cc333
- DSA-3575
- RHSA-2016:2822
- [oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability
- RHSA-2016:2823
- https://github.com/x-stream/xstream/issues/25
- [oss-security] 20160325 CVE request - XStream: XXE vulnerability
- FEDORA-2016-250042b8a6
- https://nvd.nist.gov/vuln/detail/CVE-2016-3674
Sources
- CVE-2016-3674 · CVE Program
- CVE-2016-3674 · NVD
- FIRST EPSS
- GHSA-rgh3-987h-wpmw · GitHub Advisory Database · CC BY 4.0
- CVE-2016-3674 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences