CVE-2022-40151

MEDIUM

Xstream < 1.4.20 - Denial of Service via Stack Overflow in XML Parser

Title source: llm

Description

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

References (2)

Core 2

Core References

Exploit, Permissions Required, Third Party Advisory x_refsource_misc

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367

Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/x-stream/xstream/issues/304

Scores

CVSS v3 6.5

EPSS 0.0102

EPSS Percentile 59.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-121 CWE-787

Status published

Products (2)

com.thoughtworks.xstream/xstream 0 - 1.4.20Maven

xstream/xstream < 1.4.20

Published Sep 16, 2022

Tracked Since Feb 18, 2026