CVE-2020-26258: Server-Side Forgery Request in com.thoughtworks.xstream:xstream
Summary
CVE-2020-26258: Server-Side Forgery Request can be activated unmarshalling with XStream. Affects com.thoughtworks.xstream:xstream versions < 1.4.15. Fixed in 1.4.15. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2020-26258 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source Java library that provides a simple way to serialize objects to XML and back again. It is widely used in various applications for data serialization and deserialization. However, a vulnerability has been discovered in versions 1.4.14 and below, which allows for Server-Side Forgery Request (SSFR) attacks.
Vulnerability Detail
The vulnerability in com.thoughtworks.xstream:xstream allows a remote attacker to manipulate the input stream and request data from internal resources that are not publicly available. By exploiting this vulnerability, an attacker can potentially access sensitive information and perform unauthorized actions. The vulnerability is rated with a CVSS score of 7.7, indicating a high severity level.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to version 1.4.15 or higher, there are workarounds available depending on the version you are using. For example, if you are using version 1.4.14, you can add the following lines to your XStream setup code:
xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });
It is important to note that using a workaround is not as secure as upgrading to the latest version, and it is recommended to upgrade if possible.
Conclusion
The vulnerability in com.thoughtworks.xstream:xstream can lead to Server-Side Forgery Request attacks, allowing unauthorized access to internal resources. It is crucial to upgrade to version 1.4.15 or higher to mitigate this vulnerability. If upgrading is not possible, implementing the recommended workarounds can provide some level of protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is a Java library used for object serialization and deserialization to XML.
The vulnerability allows a remote attacker to manipulate the input stream and access internal resources, potentially leading to unauthorized access and data leakage.
To fix this vulnerability, it is recommended to upgrade to at least version 1.4.15 of com.thoughtworks.xstream:xstream.
Yes, there are workarounds available depending on the version you are using. Please refer to the 'workaround' section for more details.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
