Description
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xstream | Woodstox | unspecified – < 6.4.0, unspecified – < 5.4.0 | 6.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libwoodstox-java | No fix yet | — |
| Debian 13 | libwoodstox-java | No fix yet | — |
| Debian 12 | libwoodstox-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libxstream-java | No fix yet | — |
| Ubuntu 26.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 25.10 | libxstream-java | No fix yet | — |
| Ubuntu 24.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 22.04 LTS | libxstream-java | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 18.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libxstream-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.387.3.1684911776-3.el8 | RHSA-2023:3299 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.13.1684911916-1.el8 | RHSA-2023:3299 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4437, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis-tools | 2.9.0-10.redhat_00021.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-gson | 2.8.9-1.redhat_00001.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.18-1.Final_redhat_00001.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-14.Final_redhat_00015.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4437, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:4437, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.13-4.GA_redhat_00002.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4437, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.2-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.3-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.13-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +10 | 2.12.7-1.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.1-3.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.49-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 3.0.0-6.SP07_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.0-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.27-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-24.Final_redhat_00023.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.5.2-1.redhat_00002.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.22-1.SP3_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.9-4.GA_redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.4.0-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.3 | woodstox | 4.4.2-150400.3.6.1 | SUSE-SU-2023:0679-1 |
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-150300.5.19.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | drools | 7.17.0-150300.4.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | grafana-formula | 0.8.1-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.2.7-150300.8.28.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | prometheus-formula | 0.7.0-150300.3.17.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | py27-compat-salt | 3000.3-150300.7.7.29.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | salt-netapi-client | 0.21.0-150300.3.12.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | saltboot-formula | 0.1.1676908681.e90e0b1-150300.3.15.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | smdba | 1.7.11-0.150300.3.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.21-150300.4.33.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-admin | 4.2.13-150300.3.18.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.26-150300.4.35.6 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-certs-tools | 4.2.19-150300.3.27.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.22-150300.4.30.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.47-150300.3.58.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-search | 4.2.9-150300.3.15.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.32-150300.3.36.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | supportutils-plugin-susemanager | 4.2.5-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.40-150300.3.49.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-doc-indexes | 4.2-150300.12.39.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en | 4.2-150300.12.39.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.27-150300.3.35.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.31-150300.3.43.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | uyuni-common-libs | 4.2.9-150300.3.14.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | virtual-host-gatherer | 1.0.24-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | woodstox | 4.4.2-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacecmd | 4.2.21-150300.4.33.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-backend | 4.2.26-150300.4.35.6 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-certs-tools | 4.2.19-150300.3.27.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-client-tools | 4.2.22-150300.4.30.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy | 4.2.13-150300.3.24.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy-installer | 4.2.11-150300.3.14.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-web | 4.2.32-150300.3.36.4 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | uyuni-common-libs | 4.2.9-150300.3.14.1 | SUSE-SU-2023:0592-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | woodstox-core | 7.2.1-1.1 | openSUSE-SU-2026:11226-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | woodstox-core +1 | 4.1.2-8.amzn2.0.1 | ALAS2-2024-2463 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | sonarqube-10 | 25.1.0.102122-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.woodstox:woodstox-core | >= 6.0.0, < 6.4.0 | 6.4.0 | GHSA-3f7h-mf4q-vrm4 |
| Maven | com.fasterxml.woodstox:woodstox-core | < 5.4.0 | 5.4.0 | GHSA-3f7h-mf4q-vrm4 |
Advisories 31
- RHSA-2025:4437 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.13 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:3299 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0554 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0552 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0553 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0239 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- WID-SEC-2026-2899 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2026:11226-1 woodstox-core-7.2.1-1.1 on GA media SUSE / openSUSE Security Updates · Jul 9, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- SUSE-SU-2023:0592-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0679-1 Security update for woodstox SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0209 Red Hat Integration Camel Extensions for Quarkus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 21, 2025
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- NCSC-2024-0299 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- ALAS2-2024-2463 Moderate: woodstox-core security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 19, 2024
- WID-SEC-2024-0108 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0094 Atlassian Bamboo: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2700 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
- WID-SEC-2023-1293 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 23, 2023
- WID-SEC-2023-1112 IBM Tivoli Business Service Manager: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-1023 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0741 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2023