Description
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xstream | xstream | unspecified – ≤ 1.4.19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | No fix yet | — |
| Debian 13 | libxstream-java | No fix yet | — |
| Debian 12 | libxstream-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libxstream-java | No fix yet | — |
| Ubuntu 26.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 25.10 | libxstream-java | No fix yet | — |
| Ubuntu 24.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 22.04 LTS | libxstream-java | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 18.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libxstream-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.387.3.1684911776-3.el8 | RHSA-2023:3299 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.13.1684911916-1.el8 | RHSA-2023:3299 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLES 15 SP3 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLES 15 SP2 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLES for SAP 15 SP2 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLE Real Time 15 SP3 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLE HPC 15 SP3 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SLE HPC 15 SP2 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SUSE Manager Server Module 4.3 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SUSE Manager Server Module 4.2 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SUSE Enterprise Storage 7.1 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
| SUSE Enterprise Storage 7 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xstream | 1.4.20-1.1 | openSUSE-SU-2024:12796-1 |
| openSUSE Leap 15.4 | xstream | 1.4.20-150200.3.25.1 | SUSE-SU-2023:1673-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xstream +1 | 1.3.1-16.amzn2.0.3 | ALAS2-2024-2464 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | < 1.4.20 | 1.4.20 | GHSA-f8cc-g7j8-xxpm |
Advisories 14
- RHSA-2023:3299 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- SUSE-SU-2023:1673-1 Security update for xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12796-1 xstream-1.4.20-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0086 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2023-0209 Red Hat Integration Camel Extensions for Quarkus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 21, 2025
- ALAS2-2024-2464 Moderate: xstream security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 19, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1021 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- WID-SEC-2023-1293 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 23, 2023
- WID-SEC-2023-1112 IBM Tivoli Business Service Manager: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-0741 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2023