CVE-2022-40151
XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow
Impact
### Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. ### Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead. ### Workarounds The only solution is to catch the StackOverflowError in the client code calling XStream. ### References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2022-40151](https://x-stream.github.io/CVE-2022-40151.html). ### Credits The vulnerability was discovered and reported by Henry Lin of the Google OSS-Fuzz team. ### For more information If you have any questions or comments about this advisory: * Open an issue in [XStream](https://github.com/x-stream/xstream/issues) * Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.thoughtworks.xstream:xstream | < 1.4.20 | 1.4.20 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xstream | Xstream | before 1.4.20 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367
- https://github.com/x-stream/xstream/issues/304
- https://github.com/advisories/GHSA-f8cc-g7j8-xxpm
- https://github.com/x-stream/xstream/security/advisories/GHSA-f8cc-g7j8-xxpm
- https://nvd.nist.gov/vuln/detail/CVE-2022-40151
- https://github.com/x-stream/xstream/issues/314
- https://x-stream.github.io/CVE-2022-40151.html