XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
Priority MEDIUM 43CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121, CWE-502 and the CVSS impact.
Summary
XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02001 80th percentileScored 2026-11-07
Fix Partial xstream (x-stream): 1.4.21com.thoughtworks.xstream:xstream (Maven): 1.4.21Red Hat: 10 advisoriesRed Hat: 10 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.21 | 1.4.21 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.21 | 1.4.21 | Patch available | GHSA-hfq9-hggm-c56q |
- xstream VendorXStream Affected before 1.4.21 Fixed in 1.4.21 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.21 Fixed in 1.4.21 Patch available GHSA-hfq9-hggm-c56q
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:x-stream:x-stream:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:x-stream:x-stream:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.21
- Fix · GHSA-hfq9-hggm-c56q com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.21 Advisory →
Red Hat 10 advisories
- RHSA-2025:8690 Released 2025-06-09 · Red Hat rating ImportantRed Hat build of Keycloak 26.2.5 Security Update
- Red Hat build of Keycloak 26
- RHSA-2025:8672 Released 2025-06-09 · Red Hat rating ImportantRed Hat build of Keycloak 26.2.5 Images Security Update
- Red Hat build of Keycloak 26.2 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2025:2545 Released 2025-03-10 · Red Hat rating ModerateRed Hat build of Keycloak 26.0.10 Update
- Red Hat Build of Keycloak
Show 7 more Red Hat advisories
- RHSA-2025:2223 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.12 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1740464689-1.el8, jenkins-2.479.3.1740464431-3.el8
- RHSA-2025:2221 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.14 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1740109868-1.el8, jenkins-2.479.3.1740109575-3.el8
- RHSA-2025:2220 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.15 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1740052174-1.el8, jenkins-2.479.3.1740051993-3.el8
- RHSA-2025:2218 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.17 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1739859908-1.el9, jenkins-2.479.3.1739859586-3.el9
- RHSA-2025:2222 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.13 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1740464698-1.el8, jenkins-2.479.3.1740464433-3.el8
- RHSA-2025:2219 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.16 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1739896683-1.el9, jenkins-2.479.3.1739896390-3.el9
- RHSA-2024:10214 Released 2024-11-25 · Red Hat rating ImportantRed Hat Data Grid 8.5.2 security update
- Red Hat Data Grid
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet |
| Red Hat AMQ Clients | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2025:2223 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2025:2222 |
| OpenShift Developer Tools and Services for OCP 4.14 | Fixed | RHSA-2025:2221 |
| OpenShift Developer Tools and Services for OCP 4.15 | Fixed | RHSA-2025:2220 |
| OpenShift Developer Tools and Services for OCP 4.16 | Fixed | RHSA-2025:2219 |
| OpenShift Developer Tools and Services for OCP 4.17 | Fixed | RHSA-2025:2218 |
| Red Hat Build of Keycloak | Fixed | RHSA-2025:2545 |
| Red Hat Data Grid | Fixed | RHSA-2024:10214 |
| Red Hat build of Keycloak 26 | Fixed | RHSA-2025:8690 |
| Red Hat build of Keycloak 26.2 | Fixed | RHSA-2025:8672 |
Not affected: 12 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apicurio Registry 2
- Red Hat build of Quarkus Native builder
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47072
- 2026-10-03 Alias added: GHSA-hfq9-hggm-c56q
- 2026-10-08 Affected versions changed · Red Hat
- 2026-11-03 Fix available: Red Hat Data Grid · Red Hat
References
Other 6
- https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
- https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
- https://x-stream.github.io/CVE-2024-47072.html
- https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a
- https://github.com/x-stream/xstream
- https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html
More XStream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
Sources
- CVE-2024-47072 · CVE Program
- CVE-2024-47072 · NVD
- FIRST EPSS
- GHSA-hfq9-hggm-c56q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-47072 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences