Read the docs
TI-2022-19041 Aliases CVE-2022-40152GHSA-3f7h-mf4q-vrm4

Stack Buffer Overflow in Woodstox

Priority HIGH 66CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 15 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.18215 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Woodstox (xstream): 6.4.0, 5.4.0com.fasterxml.woodstox:woodstox-core (Maven): 6.4.0, 5.4.0Red Hat: 12 advisoriesRed Hat: 12 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XStreamWoodstoxbefore 6.4.0; before 5.4.06.4.0, 5.4.0Patch availableCNA
—com.fasterxml.woodstox:woodstox-core (Maven)6.0.0 to before 6.4.06.4.0Patch availableGHSA-3f7h-mf4q-vrm4
—com.fasterxml.woodstox:woodstox-core (Maven)before 5.4.05.4.0Patch availableGHSA-3f7h-mf4q-vrm4
  • Woodstox VendorXStream Affected before 6.4.0; before 5.4.0 Fixed in 6.4.0, 5.4.0 Patch available CNA
  • com.fasterxml.woodstox:woodstox-core (Maven) Vendor— Affected 6.0.0 to before 6.4.0 Fixed in 6.4.0 Patch available GHSA-3f7h-mf4q-vrm4
  • com.fasterxml.woodstox:woodstox-core (Maven) Vendor— Affected before 5.4.0 Fixed in 5.4.0 Patch available GHSA-3f7h-mf4q-vrm4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*before 1.4.20VulnerableXStream
cpe:2.3:a:fasterxml:woodstox:*:*:*:*:*:*:*:*before 5.4.0; 6.0.0 to before 6.4.0VulnerableFasterXML
  • cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.20 Vulnerable ·XStream
  • cpe:2.3:a:fasterxml:woodstox:*:*:*:*:*:*:*:* Versions before 5.4.0; 6.0.0 to before 6.4.0 Vulnerable ·FasterXML

Remediation

  • Fix · CNA Woodstox (xstream) Fixed in 6.4.0, 5.4.0
  • Fix · GHSA-3f7h-mf4q-vrm4 com.fasterxml.woodstox:woodstox-core (Maven) Fixed in 6.4.0 Advisory →
  • Fix · GHSA-3f7h-mf4q-vrm4 com.fasterxml.woodstox:woodstox-core (Maven) Fixed in 5.4.0 Advisory →

Red Hat 12 advisories

  • RHSA-2025:4437 Released 2025-05-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.13 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2023:4983 Released 2023-09-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.4 security update
    • RHPAM 7.13.4 async
Show 9 more Red Hat advisories
  • RHSA-2023:3815 Released 2023-06-27 · Red Hat rating Important
    Service Registry (container images) release and security update [2.4.3 GA]
    • RHINT Service Registry 2.4.3 GA
  • RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
    • RHINT Camel-Springboot 3.18.3.P2
  • RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2023:0469 Released 2023-01-26 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions For Quarkus 2.13.2
    • RHINT Camel-Q 2.13.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for RuntimesAffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix yet
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2023:3299
RHINT Camel-Q 2.13.2Fixed RHSA-2023:0469
RHINT Camel-Springboot 3.18.3.P2Fixed RHSA-2023:3641
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
RHINT Service Registry 2.4.3 GAFixed RHSA-2023:3815
RHPAM 7.13.4 asyncFixed RHSA-2023:4983
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:4437
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Not affected: 13 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Developer Tools and Services for OCP 4.13
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Single Sign-On 7
  • Red Hat build of Debezium 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40152
  2. 2026-10-03 Alias added: GHSA-3f7h-mf4q-vrm4
  3. 2026-11-05 Affected versions changed · Red Hat

References

Exploit 1

Advisory 2

Other 4

  • TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
  • TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
  • TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences