CVE-2022-41966: XStream can cause Denial of Service via stack overflow
Summary
CVE-2022-41966: XStream can cause Denial of Service via stack overflow. Affects com.thoughtworks.xstream:xstream versions < 1.4.20. Fixed in 1.4.20. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2022-41966 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is an open-source Java library that allows for the serialization and deserialization of Java objects to XML and back. It provides a simple API for converting Java objects to XML and vice versa. XStream is widely used in various Java applications and frameworks.
Vulnerability Detail
The vulnerability in XStream allows a remote attacker to cause a Denial of Service (DoS) by exploiting a stack overflow error. By manipulating the processed input stream, the attacker can trigger a stack overflow and terminate the application. This can lead to service disruption and unavailability. The vulnerability affects various types of collections and maps in the Java runtime, including HashMap, HashSet, Hashtable, LinkedHashMap, and LinkedHashSet. Third-party collection implementations that use their element's hash code may also be affected.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, there are a few workarounds that can be implemented. One approach is to catch the StackOverflowError in the client code that calls XStream. Another option is to set the NO_REFERENCE mode in XStream if the object graph does not use referenced elements. Additionally, if the object graph does not contain the vulnerable types (HashMap, HashSet, etc.), the security framework can be used to deny their usage. It is also possible to change the default implementation of java.util.Map and java.util.Set at unmarshalling time to use safer alternatives like TreeMap and TreeSet.
Conclusion
The vulnerability in XStream can lead to a Denial of Service (DoS) by exploiting a stack overflow error. It is crucial to upgrade to the fixed version of XStream (1.4.20 or later) or implement the provided workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is a Java library for serializing and deserializing Java objects to XML and vice versa. It provides a simple API for converting objects to XML and back.
The vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a stack overflow error. This can lead to the termination of the application and service disruption.
The vulnerability affects XStream versions prior to 1.4.20. It is recommended to upgrade to this version or any subsequent version to mitigate the risk.
Yes, there are a few workarounds that can be implemented. These include catching the StackOverflowError in the client code, setting the NO_REFERENCE mode in XStream, denying the usage of vulnerable types, and changing the default implementation of java.util.Map and java.util.Set.
To fix the vulnerability, it is recommended to upgrade to XStream version 1.4.20 or any subsequent version. Developers should update their project's dependencies to include the fixed version of XStream.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
