XStream Denial of Service via stack overflow
Priority HIGH 75CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Denial of service
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 9 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502 and CWE-674.
Summary
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.09347 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xstream (x-stream): 1.4.20com.thoughtworks.xstream:xstream (Maven): 1.4.20Red Hat: 9 advisoriesRed Hat: 9 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.20 | 1.4.20 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.20 | 1.4.20 | Patch available | GHSA-j563-grx4-pjpv |
- xstream VendorXStream Affected before 1.4.20 Fixed in 1.4.20 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.20 Fixed in 1.4.20 Patch available GHSA-j563-grx4-pjpv
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.20
- Fix · GHSA-j563-grx4-pjpv com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.20 Advisory →
Red Hat 9 advisories
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:3625 Released 2023-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.10.62 security update
- Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1685679861-1.el8, jenkins-2.401.1.1685677065-1.el8
Show 6 more Red Hat advisories
- RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
- RHSA-2023:2041 Released 2023-04-27 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.1 for RHEL 8 mta/mta-windup-addon-rhel8
- RHSA-2023:1286 Released 2023-03-16 · Red Hat rating ImportantMigration Toolkit for Runtimes security bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8
- RHSA-2023:1177 Released 2023-03-09 · Red Hat rating ImportantRed Hat Integration Camel Extension For Quarkus 2.7-1 security update
- RHINT Camel-Q 2.7-1
- RHSA-2023:1006 Released 2023-03-08 · Red Hat rating ImportantRed Hat build of Quarkus 2.7.7 release and security update
- Red Hat build of Quarkus 2.7.7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Quarkus | Affected | No fix yet |
| MTA 6.1 for RHEL 8 | Fixed | RHSA-2023:2041 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:1286 |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3663 |
| RHINT Camel-Q 2.7-1 | Fixed | RHSA-2023:1177 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:3625 |
| Red Hat build of Quarkus 2.7.7 | Fixed | RHSA-2023:1006 |
Not affected: 13 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- MTA 6.1 for RHEL 8
- Migration Toolkit for Runtimes 1 on RHEL 8
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- Red Hat AMQ Broker 7
- Red Hat Enterprise Linux 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat OpenShift Container Platform 4.10
- Red Hat Single Sign-On 7
- Red Hat build of Debezium 1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41966
- 2026-10-03 Alias added: GHSA-j563-grx4-pjpv
References
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
Sources
- CVE-2022-41966 · CVE Program
- CVE-2022-41966 · NVD
- FIRST EPSS
- GHSA-j563-grx4-pjpv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41966 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences