Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The 1.4.x version is actively maintained.

Version	Supported
1.4.x	✅
< 1.4.0	❌

Reporting a Vulnerability

If you have identified a security issue, please open a new private security advisory. Provide there all details to reproduce the problem with the latest XStream version.

Note, that XStream cares about security issues with XStream itself or in combination with the Java runtime, but not with 3rd party libraries. It is in the resposibility of each developer who brings those libraries together to setup the XStream Security Framework properly.

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
GHSA-hfq9-hggm-c56q published Nov 7, 2024 by joehni

High
XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow
GHSA-f8cc-g7j8-xxpm published Dec 24, 2022 by joehni

High
XStream can cause a Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow
GHSA-j563-grx4-pjpv published Dec 24, 2022 by joehni

High
XStream can cause a Denial of Service by injecting highly recursive collections or maps
GHSA-rmr5-cpv2-vgjf published Jan 29, 2022 by joehni

High
XStream is vulnerable to an Arbitrary Code Execution attack
GHSA-6w62-hx7r-mw68 published Aug 22, 2021 by joehni

High
XStream is vulnerable to an Arbitrary Code Execution attack
GHSA-2q8x-2p7f-574v published Aug 22, 2021 by joehni

High
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
GHSA-xw4p-crpj-vjx2 published Aug 22, 2021 by joehni

Moderate
XStream is vulnerable to an Arbitrary Code Execution attack
GHSA-hph2-m3g5-xxv4 published Aug 22, 2021 by joehni

High
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
GHSA-cxfm-5m4g-x7xp published Aug 22, 2021 by joehni

Moderate
XStream is vulnerable to an Arbitrary Code Execution attack
GHSA-3ccq-5vw3-2p6x published Aug 22, 2021 by joehni

High

Learn more about advisories related to x-stream/xstream in the GitHub Advisory Database