Skip to content
Fencer Vulns
medium 6.5

CVE-2022-40152 json

Stack Buffer Overflow in Woodstox

published 2022-09-16 4 y ago modified 2026-09-10 1 mo ago also GHSA-3f7h-mf4q-vrm4 , EUVD-2022-6677

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
18.2%
EPSS 18.2% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Patch / fix

  • maven com.fasterxml.woodstox:woodstox-core 5.4.0, 6.4.0
  • xstream Woodstox 5.4.0, 6.4.0
  • eap7-woodstox-core jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 6.4.0-1.redhat_00001.1.el7eap
  • jenkins ocp tools 4.13 2.387.3.1684911776-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1684911916-1.el8
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.9-4.GA_redhat_00003.1.el8eap
  • eap7-jettison jboss enterprise application platform 7.4 1.5.2-1.redhat_00002.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.22-1.SP3_redhat_00001.1.el8eap
  • eap7-apache-sshd jboss enterprise application platform 7.4 2.9.2-1.redhat_00001.1.el8eap
  • eap7-elytron-web jboss enterprise application platform 7.4 1.9.3-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:4437RHSA-2025:4226RHSA-2023:3299RHSA-2023:0553RHSA-2023:0552RHSA-2023:0554

  • woodstox Manager Server Module 4.3 4.4.2-150400.3.6.1
  • smdba Manager Server Module 4.2 1.7.11-0.150300.3.12.2
  • drools Manager Server Module 4.2 7.17.0-150300.4.9.2
  • rhnlib Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.7-150300.4.12.2
  • cobbler Manager Server Module 4.2 3.1.2-150300.5.19.1
  • mgr-osad Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.9-150300.2.12.2
  • spacecmd Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.21-150300.4.33.2
  • woodstox Manager Server Module 4.2 4.4.2-150300.3.6.2

suse advisories SUSE-SU-2023:0679-1SUSE-SU-2023:0592-1

  • woodstox-core openSUSE Tumbleweed 7.2.1-1.1

opensuse advisories openSUSE-SU-2026:11226-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-40152 updated cvss 7.5

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

  • Red Hat Migration Toolkit for Runtimes xstream
    affected: no fix planned “Will not fix”
  • Red Hat build of Quarkus woodstox-core
    affected: no fix available
  • Red Hat Data Grid 8 xstream
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 woodstox-core, woodstox-core-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 woodstox-core
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel K 1 woodstox-core Red Hat Integration Camel Quarkus 1 woodstox-core
    affected: no fix available
  • Red Hat JBoss Data Grid 7 woodstox-core Red Hat JBoss Data Virtualization 6 woodstox-core Red Hat JBoss Enterprise Application Platform 6 woodstox-core Red Hat JBoss Fuse 6 woodstox-core Red Hat JBoss Fuse Service Works 6 woodstox-core
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 jenkins
    affected: no fix available
show 15 more
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat Satellite 6 woodstox-core
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.387.3.1684911776-3.el8
    fixed: vendor fix RHSA-2023:3299
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:0552
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:0553
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0554
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7, eap7-wildfly 7.1.10-2.GA_redhat_00002.1.ep7.el7, eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7, eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7, eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7, eap7-artemis-native 1.5.5.016-1.redhat_00001.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:4226
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-gson 2.8.9-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.13-4.GA_redhat_00002.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-10.redhat_00021.1.el7eap, eap7-hal-console 3.2.18-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.13-4.GA_redhat_00002.1.el7eap, +41 more
    fixed: vendor fix RHSA-2025:4437
  • Red Hat JBoss Enterprise Application Platform 7.4.9 woodstox-core 6.4.0.redhat-00001
    fixed: vendor fix RHSA-2023:0556
  • Red Hat RHINT Camel-Q 2.13.2
    fixed: vendor fix RHSA-2023:0469
  • Red Hat RHINT Camel-Springboot 3.18.3.P2
    fixed: vendor fix RHSA-2023:3641
  • Red Hat RHINT Camel-Springboot 3.20.1
    fixed: vendor fix RHSA-2023:2100
  • Red Hat RHINT Service Registry 2.4.3 GA
    fixed: vendor fix RHSA-2023:3815
  • Red Hat RHPAM 7.13.4 async
    fixed: vendor fix RHSA-2023:4983
  • Red Hat A-MQ Clients 2 woodstox-core Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1684911916-1.el8 Red Hat AMQ Broker 7 woodstox-core Red Hat build of Debezium 1 woodstox-core Red Hat Data Grid 8 woodstox-core
    +7 more products
    Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el8eap, +40 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el9eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el9eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el9eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el9eap, +40 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1535 more Red Hat JBoss Enterprise Application Platform Expansion Pack woodstox-core Red Hat OpenShift Application Runtimes woodstox-core Red Hat Single Sign-On 7 woodstox-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

18.21% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.woodstox:woodstox-core
>=6.0.0, <6.4.0
<5.4.0
6.4.0
5.4.0

Affected products

  • xstream Woodstox

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.