Skip to content
Fencer Vulns
high 8.2

CVE-2022-41966 json

XStream Denial of Service via stack overflow

published 2022-12-27 3 y ago modified 2026-06-17 4 mo ago also GHSA-j563-grx4-pjpv , EUVD-2022-7656

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
9.3%
EPSS 9.3% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

Patch / fix

  • maven com.thoughtworks.xstream:xstream 1.4.20
  • xstream xstream 1.4.20
  • libxstream-java Debian 14, Debian 13, Debian 12 1.4.20-1

debian advisories DEBIAN-CVE-2022-41966

  • libxstream-java Ubuntu 18.04 LTS 1.4.11.1-1+deb10u4build0.18.04.1
  • libxstream-java Ubuntu 20.04 LTS 1.4.11.1-1ubuntu0.3
  • libxstream-java Ubuntu 22.04 LTS 1.4.18-2ubuntu0.1
  • libxstream-java Ubuntu Pro 14.04 LTS 1.4.7-1ubuntu0.1+esm1
  • libxstream-java Ubuntu Pro 16.04 LTS 1.4.8-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2022-41966

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins openshift 4.10 2.401.1.1685677065-1.el8
  • jenkins-2-plugins openshift 4.10 4.10.1685679861-1.el8
  • jenkins ocp tools 4.11 2.401.1.1686831596-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1686831822-1.el8

red hat advisories RHSA-2023:3625RHSA-2023:3663

  • xstream SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +11 more 1.4.20-150200.3.25.1

suse advisories SUSE-SU-2023:1673-1

  • xstream openSUSE Tumbleweed 1.4.20-1.1

opensuse advisories openSUSE-SU-2024:12796-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41966 updated cvss 7.5

xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow

  • Red Hat build of Apicurio Registry 2 xstream Red Hat build of Quarkus xstream Red Hat Data Grid 8 xstream Red Hat Decision Manager 7 xstream Red Hat Integration Camel K 1 xstream Red Hat Integration Camel Quarkus 1 xstream
    affected: no fix available
  • Red Hat JBoss Data Grid 7 xstream Red Hat JBoss Enterprise Application Platform 6 xstream, keycloak-adapter-eap6 keycloak-adapter-eap6, keycloak-adapter-sso7_2-eap6 keycloak-adapter-sso7_2-eap6, keycloak-adapter-sso7_3-eap6 keycloak-adapter-sso7_3-eap6 Red Hat JBoss Fuse 6 xstream Red Hat JBoss Fuse Service Works 6 xstream
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 jenkins
    affected: no fix available
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8 1.0-22
    fixed: vendor fix RHSA-2023:1286
  • Red Hat MTA 6.1 for RHEL 8 mta/mta-windup-addon-rhel8 6.1.0-11
    fixed: vendor fix RHSA-2023:2041
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.401.1.1686831596-3.el8
    fixed: vendor fix RHSA-2023:3663
  • Red Hat build of Quarkus 2.7.7
    fixed: vendor fix RHSA-2023:1006
  • Red Hat Fuse 7.12
    fixed: vendor fix RHSA-2023:3954
show 5 more
  • Red Hat OpenShift Container Platform 4.10 jenkins 2.401.1.1685677065-1.el8
    fixed: vendor fix RHSA-2023:3625
  • Red Hat RHINT Camel-Q 2.7-1
    fixed: vendor fix RHSA-2023:1177
  • Red Hat RHINT Camel-Springboot 3.20.1
    fixed: vendor fix RHSA-2023:2100
  • Red Hat RHPAM 7.13.5 async
    fixed: vendor fix RHSA-2024:1353
  • Red Hat A-MQ Clients 2 xstream Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.0-13, mtr/mtr-operator-bundle 1.0-37, mtr/mtr-web-executor-container-rhel8 1.0-21 Red Hat MTA 6.1 for RHEL 8 mta/mta-ui-rhel8 6.1.0-13, mta/mta-hub-rhel8 6.1.0-10, mta/mta-rhel8-operator 6.1.0-11, mta/mta-operator-bundle 6.1.0-16, mta/mta-pathfinder-rhel8 6.1.0-7 Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1686831822-1.el8 Red Hat AMQ Broker 7 xstream
    +7 more products
    Red Hat build of Debezium 1 xstream Red Hat Enterprise Linux 7 xstream, xstream-javadoc Red Hat JBoss Enterprise Application Platform 7 xstream Red Hat JBoss Enterprise Application Platform Expansion Pack xstream Red Hat OpenShift Application Runtimes xstream Red Hat OpenShift Container Platform 4.10 perf 4.18.0-305.93.1.el8_4, kernel 4.18.0-305.93.1.el8_4, bpftool 4.18.0-305.93.1.el8_4, kernel-core 4.18.0-305.93.1.el8_4, kernel-tools 4.18.0-305.93.1.el8_4, python3-perf 4.18.0-305.93.1.el8_4, +47 more Red Hat Single Sign-On 7 rh-sso7-keycloak rh-sso7-keycloak
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

9.35% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • x-stream.github.io https://x-stream.github.io/CVE-2022-41966.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
maven com.thoughtworks.xstream:xstream
<1.4.20
1.4.20

Affected products

  • x-stream xstream

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
  • CWE-121 Stack-based Buffer Overflow
  • CWE-502 Deserialization of Untrusted Data
  • CWE-674 Uncontrolled Recursion

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.