Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | 1.4.9-1 | — |
| Debian 13 | libxstream-java | 1.4.9-1 | — |
| Debian 12 | libxstream-java | 1.4.9-1 | — |
| Debian 8 | libxstream-java | 1.4.7-2+deb8u1 | DSA-3575-1 |
| Debian 7 | libxstream-java | 1.4.2-1+deb7u1 | DLA-504-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libxstream-java | 1.4.8-1ubuntu0.1+esm3 | USN-6978-1 |
| Ubuntu Pro 14.04 LTS | libxstream-java | 1.4.7-1ubuntu0.1+esm2 | USN-6978-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xstream | 1.4.18-1.1 | openSUSE-SU-2024:10592-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | < 1.4.9 | 1.4.9 | GHSA-rgh3-987h-wpmw |
Advisories 6
- USN-6978-1 libxstream-java vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-504-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3575-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10592-1 xstream-1.4.18-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
References
- http://x-stream.github.io/changes.html#1.4.9
- FEDORA-2016-de909cc333 vendor-advisory
- DSA-3575 vendor-advisory
- RHSA-2016:2822 vendor-advisory
- 85381 vdb-entry
- 1036419 vdb-entry
- [oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability mailing-list
- RHSA-2016:2823 vendor-advisory
- https://github.com/x-stream/xstream/issues/25
- [oss-security] 20160325 CVE request - XStream: XXE vulnerability mailing-list
- FEDORA-2016-250042b8a6 vendor-advisory