XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles…
Priority MEDIUM 47CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04928 92nd percentileScored 2026-11-07
Fix Partial com.thoughtworks.xstream:xstream (Maven): 1.4.10Red Hat: 3 advisoriesRed Hat: 4 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.10 | 1.4.10 | Patch available | GHSA-7hwc-46rm-65jh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.10 Fixed in 1.4.10 Patch available GHSA-7hwc-46rm-65jh
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:* | 1 | Vulnerable | Red Hat |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | up to 1.4.9 | Vulnerable | XStream |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Red Hat
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions up to 1.4.9 Vulnerable ·XStream
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-7hwc-46rm-65jh com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.10 Advisory →
Red Hat 3 advisories
- RHSA-2017:2889 Released 2017-10-12 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.4.6 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2017:2888 Released 2017-10-12 · Red Hat rating ImportantRed Hat JBoss BRMS 6.4.6 security update
- Red Hat JBoss BRMS 6.4
- RHSA-2017:1832 Released 2017-08-10 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Virtualization 3 | Affected | — |
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:1832 |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2017:2889 |
| Red Hat JBoss BRMS 6.4 | Fixed | RHSA-2017:2888 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:1832 |
Not affected: 2 products
- Red Hat OpenShift Enterprise 2
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7957
- 2026-10-03 Alias added: GHSA-7hwc-46rm-65jh
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 6
Other 5
- https://www-prd-trops.events.ibm.com/node/715749
- https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604ab
- https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d
- https://github.com/x-stream/xstream/commit/b3570be2f39234e61f99f9a20640756ea71b1b4
- https://github.com/x-stream/xstream
Sources
- CVE-2017-7957 · CVE Program
- CVE-2017-7957 · NVD
- FIRST EPSS
- GHSA-7hwc-46rm-65jh · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7957 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences