~ / search / GHSA-f8cc-g7j8-xxpm

GHSA-f8cc-g7j8-xxpm

XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow

Source: GitHub Advisory Database (reviewed) High CVE-2022-40151

Packages

EcosystemPackageAffectedFixed in
Maven com.thoughtworks.xstream:xstream < 1.4.20 1.4.20

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. ### Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead. ### Workarounds The only solution is to catch the StackOverflowError in the client code calling XStream. ### References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2022-40151](https://x-stream.github.io/CVE-2022-40151.html). ### Credits The vulnerability was discovered and reported by Henry Lin of the Google OSS-Fuzz team. ### For more information If you have any questions or comments about this advisory: * Open an issue in [XStream](https://github.com/x-stream/xstream/issues) * Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)

References

External links from the advisory. They lead to third-party sites.