CVE-2017-7957: Denial of Service in XStream
Summary
CVE-2017-7957: Denial of service in XStream. Affects com.thoughtworks.xstream:xstream versions < 1.4.10. Fixed in 1.4.10. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2017-7957 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a Java library that provides a simple way to serialize objects to XML and back again. It is widely used in various applications and frameworks. The vulnerability identified as CVE-2017-7957 affects XStream versions up to 1.4.9. This vulnerability allows an attacker to trigger a denial of service (DoS) by exploiting a flaw in the unmarshalling process. By attempting to create an instance of the primitive type 'void' during unmarshalling, an attacker can cause the remote application to crash.
Vulnerability Detail
The vulnerability in XStream arises when a certain workaround, known as denyTypes, is not used. In this scenario, if an attacker sends a specially crafted XML payload containing the '<void/>' element, the unmarshalling process mishandles the attempt to create a 'void' instance. This mishandling leads to a remote application crash, resulting in a denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to note that this vulnerability only affects XStream versions up to 1.4.9.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by using the denyTypes feature in XStream. By configuring XStream to deny the creation of 'void' instances, the vulnerability can be mitigated. Here is an example of how to enable the denyTypes feature:
XStream xstream = new XStream();
xstream.denyTypes();
Conclusion
The vulnerability identified as CVE-2017-7957 in XStream can be exploited to cause a denial of service by crashing a remote application. To mitigate this vulnerability, it is advised to upgrade to XStream version 1.4.10 or later. Alternatively, the denyTypes workaround can be implemented. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is a Java library used for object serialization to XML and vice versa. It simplifies the process of converting Java objects into XML format.
The vulnerability allows an attacker to trigger a denial of service by causing a remote application to crash. This can lead to service disruption and potential loss of data.
XStream versions up to 1.4.9 are affected by this vulnerability. Versions 1.4.10 and later have addressed the issue.
To fix this vulnerability, it is recommended to upgrade to XStream version 1.4.10 or later. Alternatively, you can implement the denyTypes workaround as described in the documentation.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
