CVE-2022-40152

MEDIUM

xstream/xstream < 1.4.20 - Denial of Service via Stack Overflow in XML Parsing

Title source: llm

Description

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

References (2)

Core 2

Core References

Exploit, Permissions Required, Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434

Issue Tracking, Third Party Advisory

https://github.com/x-stream/xstream/issues/304

Scores

CVSS v3 6.5

EPSS 0.1965

EPSS Percentile 97.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-121 CWE-787

Status published

Products (3)

com.fasterxml.woodstox/woodstox-core 6.0.0 - 6.4.0Maven

fasterxml/woodstox < 5.4.0

xstream/xstream < 1.4.20

Published Sep 16, 2022

Tracked Since Feb 18, 2026