CVE-2017-7957

HIGH

Redhat Fuse < 1.4.9 - Improper Input Validation

Title source: rule

Exploitation Summary

EIP tracks 2 public exploits for CVE-2017-7957. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository contains benchmarking code for XStream but lacks any exploit code or technical analysis related to CVE-2017-7957. The files are part of a performance testing framework and do not demonstrate the vulnerability.

Description

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

Exploits (2)

nomisec STUB

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2017-7957-xstream-vulnerable

View Code ZIP pw:eip

This repository contains benchmarking code for XStream but lacks any exploit code or technical analysis related to CVE-2017-7957. The files are part of a performance testing framework and do not demonstrate the vulnerability.

Classification

Stub 90%

Attack Type

Deserialization

Complexity

Theoretical

Reliability

Theoretical

Target: XStream (version not specified)

No auth needed

Prerequisites: None identified

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Mar 14, 2026 Full analysis →

nomisec STUB

by andikahilmy · poc

https://github.com/andikahilmy/CVE-2017-7957-xstream-vulnerable

View Code ZIP pw:eip

The repository contains only benchmarking code for XStream and lacks any exploit or vulnerability demonstration for CVE-2017-7957. No PoC or technical analysis of the deserialization vulnerability is present.

Classification

Stub 90%

Attack Type

Deserialization

Complexity

Trivial

Reliability

Theoretical

Target: XStream (version not specified)

No auth needed

devstral-2 · analyzed Feb 18, 2026 Full analysis →