Server-Side Forgery Request can be activated unmarshalling with XStream
Priority HIGH 80CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 6 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.81817 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xstream (x-stream): 1.4.15com.thoughtworks.xstream:xstream (Maven): 1.4.15Red Hat: 6 advisoriesRed Hat: 6 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.15 | 1.4.15 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.15 | 1.4.15 | Patch available | GHSA-4cch-wxpw-8p28 |
- xstream VendorXStream Affected before 1.4.15 Fixed in 1.4.15 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.15 Fixed in 1.4.15 Patch available GHSA-4cch-wxpw-8p28
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* | before 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | before 1.4.15 | Vulnerable | XStream |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions before 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.15 Vulnerable ·XStream
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.15
- Fix · GHSA-4cch-wxpw-8p28 com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.15 Advisory →
Red Hat 6 advisories
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
Show 3 more Red Hat advisories
- RHSA-2021:2476 Released 2021-06-17 · Red Hat rating ModerateRed Hat Decision Manager 7.11.0 security update
- RHDM 7.11.0
- RHSA-2021:2475 Released 2021-06-17 · Red Hat rating ModerateRed Hat Process Automation Manager 7.11.0 security update
- RHPAM 7.11.0
- RHSA-2021:2139 Released 2021-05-26 · Red Hat rating CriticalRed Hat Data Grid 8.2.0 security update
- Red Hat Data Grid 8.2.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| RHDM 7.11.0 | Fixed | RHSA-2021:2476 |
| RHPAM 7.11.0 | Fixed | RHSA-2021:2475 |
| Red Hat Data Grid 8.2.0 | Fixed | RHSA-2021:2139 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26258
- 2026-10-03 Alias added: GHSA-4cch-wxpw-8p28
- 2026-10-07 CISA SSVC decision points changed
References
Advisory 6
- https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28
- https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html
- https://security.netapp.com/advisory/ntap-20210409-0005
- https://www.debian.org/security/2021/dsa-4828
- https://nvd.nist.gov/vuln/detail/CVE-2020-26258
- https://security.netapp.com/advisory/ntap-20210409-0005/
Other 9
- https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://github.com/x-stream/xstream
- https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
Sources
- CVE-2020-26258 · CVE Program
- CVE-2020-26258 · NVD
- FIRST EPSS
- GHSA-4cch-wxpw-8p28 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26258 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences