com.thoughtworks.xstream:xstream (Maven)
Advisories
40
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.4.21 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>com.thoughtworks.xstream</groupId><artifactId>xstream</artifactId><version>1.4.21</version></dependency>gradle
implementation("com.thoughtworks.xstream:xstream:1.4.21")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hfq9-hggm-c56q XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream |
High EPSS 2.00% |
< 1.4.21 | 1.4.21 |
| GHSA-f8cc-g7j8-xxpm XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow |
High EPSS 2.22% |
< 1.4.20 | 1.4.20 |
| GHSA-j563-grx4-pjpv XStream can cause Denial of Service via stack overflow |
High EPSS 9.35% |
< 1.4.20 | 1.4.20 |
| GHSA-3mq5-fq9h-gj7j Duplicate Advisory: Denial of Service due to parser crash Withdrawn |
Low | <= 1.4.19 | No fix yet |
| GHSA-rmr5-cpv2-vgjf Denial of Service by injecting highly recursive collections or maps in XStream |
High EPSS 7.93% |
< 1.4.19 | 1.4.19 |
| GHSA-64xx-cq4q-mf44 XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.54% |
< 1.4.18 | 1.4.18 |
| GHSA-6wf9-jmg9-vxcc XStream can cause a Denial of Service |
Medium EPSS 5.92% |
< 1.4.18 | 1.4.18 |
| GHSA-g5w6-mrj7-75h2 XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 16.12% |
< 1.4.18 | 1.4.18 |
| GHSA-8jrj-525p-826v XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.06% |
< 1.4.18 | 1.4.18 |
| GHSA-p8pq-r894-fm8f XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 14.30% |
< 1.4.18 | 1.4.18 |
| GHSA-h7v4-7xg3-hxcc XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.74% |
< 1.4.18 | 1.4.18 |
| GHSA-qrx8-8545-4wg2 XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.74% |
< 1.4.18 | 1.4.18 |
| GHSA-3ccq-5vw3-2p6x XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.74% |
< 1.4.18 | 1.4.18 |
| GHSA-cxfm-5m4g-x7xp A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host |
High EPSS 3.44% |
< 1.4.18 | 1.4.18 |
| GHSA-hph2-m3g5-xxv4 XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.74% |
< 1.4.18 | 1.4.18 |
| GHSA-xw4p-crpj-vjx2 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host |
High EPSS 11.38% |
< 1.4.18 | 1.4.18 |
| GHSA-2q8x-2p7f-574v XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.46% |
< 1.4.18 | 1.4.18 |
| GHSA-6w62-hx7r-mw68 XStream is vulnerable to an Arbitrary Code Execution attack |
High EPSS 4.74% |
< 1.4.18 | 1.4.18 |
| CVE-2021-39144 XStream is vulnerable to a Remote Command Execution attack Known exploited |
High EPSS 98.12% |
< 1.4.18 | 1.4.18 |
| CVE-2021-39144 XStream is vulnerable to a Remote Command Execution attack Known exploited |
High EPSS 98.12% |
< 1.4.18 | 1.4.18 |
| GHSA-7chv-rrw6-w6fc XStream is vulnerable to a Remote Command Execution attack |
High EPSS 77.23% |
< 1.4.17 | 1.4.17 |
| GHSA-hrcp-8f3q-4w2c XStream is vulnerable to an Arbitrary Code Execution attack |
Medium EPSS 82.14% |
< 1.4.16 | 1.4.16 |
| GHSA-43gc-mjxg-gvrq XStream is vulnerable to an Arbitrary Code Execution attack |
Medium EPSS 15.23% |
< 1.4.16 | 1.4.16 |
| GHSA-f6hm-88x3-mfjv A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host |
Medium EPSS 46.83% |
< 1.4.16 | 1.4.16 |
| GHSA-56p8-3fh9-4cvq XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) |
Medium EPSS 13.83% |
< 1.4.16 | 1.4.16 |
| GHSA-qpfq-ph7r-qv6f XStream is vulnerable to an Arbitrary Code Execution attack |
Medium EPSS 14.30% |
< 1.4.16 | 1.4.16 |
| GHSA-4hrm-m67v-5cxr XStream is vulnerable to an Arbitrary Code Execution attack |
Medium EPSS 76.37% |
< 1.4.16 | 1.4.16 |
| GHSA-hwpc-8xqv-jvj4 XStream is vulnerable to a Remote Command Execution attack |
Medium EPSS 72.32% |
< 1.4.16 | 1.4.16 |
| GHSA-59jw-jqf4-3wq3 XStream is vulnerable to an Arbitrary Code Execution attack |
Medium EPSS 75.98% |
< 1.4.16 | 1.4.16 |
| GHSA-74cv-f58x-f9wf XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights |
Medium EPSS 46.67% |
< 1.4.16 | 1.4.16 |
| GHSA-hvv8-336g-rx3m A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host |
Medium EPSS 49.99% |
< 1.4.16 | 1.4.16 |
| GHSA-2p3x-qw9c-25hh XStream can cause a Denial of Service. |
High EPSS 77.80% |
< 1.4.16 | 1.4.16 |
| GHSA-4cch-wxpw-8p28 Server-Side Forgery Request can be activated unmarshalling with XStream |
Medium EPSS 81.82% |
< 1.4.15 | 1.4.15 |
| GHSA-jfvx-7wrx-43fh XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling |
Medium EPSS 82.39% |
< 1.4.15 | 1.4.15 |
| GHSA-mw36-7c6c-q4q2 XStream can be used for Remote Code Execution |
High EPSS 82.72% |
< 1.4.14-java7 | 1.4.14-java7 |
| GHSA-7hwc-46rm-65jh Denial of service in XStream |
High EPSS 4.93% |
< 1.4.10 | 1.4.10 |
| GHSA-rgh3-987h-wpmw XML External Entity Injection in XStream |
High EPSS 8.18% |
< 1.4.9 | 1.4.9 |
| GHSA-hf23-9pf7-388p Deserialization of Untrusted Data and Code Injection in xstream |
Critical EPSS 95.04% |
>= 1.4.10, < 1.4.11 | 1.4.11 |
| GHSA-f554-x222-wgf7 Command Injection in Xstream |
Critical EPSS 84.36% |
>= 1.4.10, < 1.4.11 | 1.4.11 |
| GHSA-f554-x222-wgf7 Command Injection in Xstream |
Critical EPSS 84.36% |
< 1.4.7 | 1.4.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor