CVE-2022-41966
XStream Denial of Service via stack overflow
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.
Timeline
ID reserved
By GitHub_M
- 3 months later
· 3 months later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
| NVDNVD · Analyzed | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 9.3% · top 4.6% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Weakness
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs
- CWE-121: Stack-based Buffer Overflow (opens in a new tab)All about CWE-121 and its CVEs
- CWE-502: Deserialization of Untrusted Data (opens in a new tab)All about CWE-502 and its CVEs
- CWE-674 (opens in a new tab)All about CWE-674 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavencom.thoughtworks.xstream:xstreamGHSA-j563-grx4-pjpv (opens in a new tab)
References (3)
- https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://x-stream.github.io/CVE-2022-41966.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20230216-0005/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-j563-grx4-pjpv (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-41966)Record last updated .