Description
XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| x-stream | xstream | < 1.4.21 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | 1.4.21-1 | — |
| Debian 13 | libxstream-java | 1.4.21-1 | — |
| Debian 12 | libxstream-java | 1.4.20-1+deb12u1 | — |
| Debian 11 | libxstream-java | 1.4.15-3+deb11u3 | DLA-4001-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libxstream-java | No fix yet | — |
| Ubuntu 26.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 25.10 | libxstream-java | No fix yet | — |
| Ubuntu 24.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 22.04 LTS | libxstream-java | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu 18.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libxstream-java | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libxstream-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.479.3.1739859586-3.el9 | RHSA-2025:2223, RHSA-2025:2222, RHSA-2025:2221 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1740464689-1.el8 | RHSA-2025:2223, RHSA-2025:2222, RHSA-2025:2221 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP6 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP5 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP5 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP4 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP4 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP3 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP3 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP2 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES 15 SP2 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES for SAP 15 SP4 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES for SAP 15 SP3 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES for SAP 15 SP3 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLES for SAP 15 SP2 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLES for SAP 15 SP2 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP4 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP4 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP3 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP3 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP2 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SLE HPC 15 SP2 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SUSE Manager Server Module 4.3 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| SUSE Manager Server 4.3 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SUSE Manager Proxy 4.3 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SUSE Enterprise Storage 7.1 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| SUSE Enterprise Storage 7.1 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xstream | 1.4.21-1.1 | openSUSE-SU-2024:14480-1 |
| openSUSE Leap 15.6 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| openSUSE Leap 15.6 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
| openSUSE Leap 15.5 | bea-stax | 1.2.0-150200.11.3.1 | SUSE-SU-2024:4037-1 |
| openSUSE Leap 15.5 | xstream | 1.4.21-150200.3.28.1 | SUSE-SU-2024:4037-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xstream +1 | 1.3.1-16.amzn2.0.4 | ALAS2-2024-2707 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | < 1.4.21 | 1.4.21 | GHSA-hfq9-hggm-c56q |
Advisories 27
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RHSA-2025:2223 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2222 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2220 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2221 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2219 Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:2218 Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- DLA-4001-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14480-1 xstream-1.4.21-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4037-1 Security update for bea-stax, xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0463 Keycloak (XStream und Infinispan): Multiple Vulnerabilities BSI CERT-Bund (WID) · Jan 29, 2026
- WID-SEC-2025-0400 Atlassian Bamboo/Jira : Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 11, 2025
- WID-SEC-2024-3544 Red Hat JBoss Data Grid: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- WID-SEC-2025-1572 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-1565 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0127 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0824 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0819 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0805 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- ALAS2-2024-2707 Important: xstream security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2024