Stack Buffer Overflow in xstream
Priority HIGH 66CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 15 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121, CWE-502 and the CVSS impact.
Summary
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02222 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.thoughtworks.xstream:xstream (Maven): 1.4.20Red Hat: 4 advisoriesRed Hat: 4 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | up to 1.4.19 | — | No fix listed | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.20 | 1.4.20 | Patch available | GHSA-f8cc-g7j8-xxpm |
- xstream VendorXStream Affected up to 1.4.19 Fixed in — No fix listed CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.20 Fixed in 1.4.20 Patch available GHSA-f8cc-g7j8-xxpm
Remediation
- Fix · GHSA-f8cc-g7j8-xxpm com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.20 Advisory →
Red Hat 4 advisories
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
- RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
Show 1 more Red Hat advisories
- RHSA-2023:0469 Released 2023-01-26 · Red Hat rating ModerateRed Hat Integration Camel Extensions For Quarkus 2.13.2
- RHINT Camel-Q 2.13.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2023:3299 |
| RHINT Camel-Q 2.13.2 | Fixed | RHSA-2023:0469 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
Not affected: 10 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- OpenShift Developer Tools and Services for OCP 4.13
- Red Hat AMQ Broker 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat build of Apicurio Registry 2
- Red Hat build of Debezium 1
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40151
- 2026-10-03 Alias added: GHSA-f8cc-g7j8-xxpm
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 2
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
Sources
- CVE-2022-40151 · CVE Program
- CVE-2022-40151 · NVD
- FIRST EPSS
- GHSA-f8cc-g7j8-xxpm · GitHub Advisory Database · CC BY 4.0
- CVE-2022-40151 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences