{"id":"CVE-2024-47072","aliases":["CLSA-2026-1784250511","DEBIAN-CVE-2024-47072","DLA-4001-1","EUVD-2024-3262","GHSA-hfq9-hggm-c56q","GHSA-j563-grx4-pjpv","GHSA-rmr5-cpv2-vgjf","OESA-2024-2400","RHLW-2026-c69885b4933c8262","RHLW-2026-f1a22cabc5a36f13","RHSA-2025:2218","RHSA-2025:2219","RHSA-2025:2220","RHSA-2025:2221","RHSA-2025:2222","RHSA-2025:2223","ROOT-APP-MAVEN-CVE-2024-47072","SUSE-SU-2024:4037-1","UBUNTU-CVE-2024-47072","openSUSE-SU-2024:14480-1"],"status":"published","title":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02001,"percentile":0.80937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-502"],"published":"2024-11-07T21:51:17Z","modified":"2026-11-02T19:45:46Z","fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.21"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.20-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.21-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xstream","fixed_in":["1.4.20-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xstream","fixed_in":["1.4.20-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"xstream","fixed_in":["1.4.20-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xstream","fixed_in":["1.4.20-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"xstream","fixed_in":["1.4.20-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.20.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.thoughtworks.xstream:xstream","fixed_in":["1.4.20-root.io.1","1.4.20-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.20-aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"bea-stax","fixed_in":["1.2.0-150200.11.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xstream","fixed_in":["1.4.21-150200.3.28.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xstream","fixed_in":["1.4.21-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.17"},{"fixed":"1.4.17-tuxcare.2"}]}],"versions":["1.4.17","1.4.17-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-1+deb12u1"}]}],"versions":["1.4.20-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3+deb11u3"}]}],"versions":["1.4.15-3","1.4.15-3+deb11u1","1.4.15-3+deb11u2"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.10","1.4.10-java7","1.4.11","1.4.11-java7","1.4.11.1","1.4.12","1.4.12-java7","1.4.13","1.4.13-java7","1.4.14","1.4.14-java7","1.4.14-jdk7","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18.rhlw-00006"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.10","1.4.10-java7","1.4.11","1.4.11-java7","1.4.11.1","1.4.12","1.4.12-java7","1.4.13","1.4.13-java7","1.4.14","1.4.14-java7","1.4.14-jdk7","1.4.15","1.4.16","1.4.17","1.4.18","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"bundled":3},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.20"},{"fixed":"1.4.20.rhlw-00001"}]}],"versions":["1.4.20"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1739859586-3.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.1739859908-1.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1739896390-3.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.1739896683-1.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1740051993-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15.1740052174-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1740109575-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1740109868-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1740464433-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1740464698-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1740464431-3.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1740464689-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-root.io.1"},{"fixed":"1.4.20-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150200.11.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-150200.3.28.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1","1.4.7-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2","1.4.8-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04","1.4.11.1-1~18.04.1","1.4.11.1-1~18.04.2","1.4.11.1-1+deb10u4build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11.1-1","1.4.11.1-1ubuntu0.1","1.4.11.1-1ubuntu0.2","1.4.11.1-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.15-4","1.4.18-2","1.4.18-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-1.1"}]}]}],"products":[{"vendor":"x-stream","product":"x-stream"},{"vendor":"x-stream","product":"xstream"}],"references":[{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://x-stream.github.io/CVE-2024-47072.html","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html","tags":["web"]},{"url":"https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hfq9-hggm-c56q","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47072.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47072","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2400","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846","tags":["fix"]},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43859","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmr5-cpv2-vgjf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41966.json","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41966","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j563-grx4-pjpv","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2218","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2316421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2324606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326047","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2218.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47072","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47855","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47855","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wwcp-26wc-3fxm","tags":["advisory"]},{"url":"https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e","tags":["article"]},{"url":"https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52549","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52550","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52551","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2219","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2219.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2220","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2220.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2221","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2221.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2222","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2222.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2223","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2223.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2342463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45339","tags":["advisory"]},{"url":"https://github.com/golang/glog/pull/74","tags":["article"]},{"url":"https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs","tags":["article"]},{"url":"https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3372","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47072","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-47072","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-47072","title":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-07T23:38:52.978Z","modified":"2025-11-03T22:19:56.488Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121","CWE-502"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-3262","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-07T23:38:52Z","modified":"2025-11-03T22:19:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-hfq9-hggm-c56q","title":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream","description":"### Impact\nThe vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver.\n\n### Patches\nXStream 1.4.21 detects the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead.\n\n### Workarounds\nThe only solution is to catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.\n\n### References\nSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2024-47072](https://x-stream.github.io/CVE-2024-47072.html).\n\n### Credits\nAlexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.","status":"published","published":"2024-11-07T21:51:17Z","modified":"2025-11-04T16:53:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-121","CWE-502"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-08T00:15:14.937Z","modified":"2026-06-17T07:56:29.67Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121","CWE-502"],"updated_at":"2026-11-02T14:10:36.560164Z"}],"osv":[{"id":"CVE-2024-47072","title":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-07T23:38:52.978Z","modified":"2026-10-28T10:58:20.396918171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-121","CWE-502"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"DEBIAN-CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-08T00:15:14.937Z","modified":"2026-11-02T12:02:50.802936332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"GHSA-hfq9-hggm-c56q","title":"XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream","description":"### Impact\nThe vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver.\n\n### Patches\nXStream 1.4.21 detects the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead.\n\n### Workarounds\nThe only solution is to catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.\n\n### References\nSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2024-47072](https://x-stream.github.io/CVE-2024-47072.html).\n\n### Credits\nAlexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.","status":"published","published":"2024-11-07T21:51:17Z","modified":"2026-08-07T08:12:24.322064352Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-121","CWE-502"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"OESA-2024-2400","title":"xstream security update","description":"XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for large object graphs or systems with high message throughput. No information is duplicated that can be obtained via reflection. This results in XML that is easier to read for humans and more compact than native Java serialization. XStream serializes internal fields, including private and final. Supports non-public and inner classes. Classes are not required to have default constructor. Duplicate references encountered in the object-model will be maintained. Supports circular references. By implementing an interface, XStream can serialize directly to/from any tree structure (not just XML). Strategies can be registered allowing customization of how particular types are represented as XML. When an exception occurs due to malformed XML, detailed diagnostics are provided to help isolate and fix the problem.\r\n\r\nSecurity Fix(es):\r\n\r\nXStream provides a BinaryStreamDriver with an own optimized serialization format. The format uses ids for string values as deduplication. The mapping for these ids are created on-the-fly at marshalling time. At unmarshalling time the reader_x27;s implementation simply used a simple one-time recursion after reading a mapping token to process the next normal token of the data stream. However, an endless recursion could be triggered with manipulated input data resulting in a stack overflow causing a denial of service.(CVE-2024-47072)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.568191017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHLW-2026-c69885b4933c8262","title":"Lightwell Security Advisory: xstream 1.4.18.rhlw-00006","description":"Red Hat Lightwell has released com.thoughtworks.xstream:xstream 1.4.18.rhlw-00006 with backported fixes for CVE-2021-43859, CVE-2022-41966, and CVE-2024-47072.\n\nCVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.\n\nCVE-2022-41966: XStream Denial of Service via stack overflow \n\nCVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream\n\nThis patched artifact is a drop-in replacement for com.thoughtworks.xstream:xstream 1.4.18 from Maven Central.","status":"published","published":"2026-09-24T16:39:11Z","modified":"2026-10-27T04:13:06.183629728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-f1a22cabc5a36f13","title":"Lightwell Security Advisory: xstream 1.4.20.rhlw-00001","description":"Red Hat Lightwell has released com.thoughtworks.xstream:xstream 1.4.20.rhlw-00001 with a backported security fix.\n\nCVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream\n\nThis patched artifact is a drop-in replacement for com.thoughtworks.xstream:xstream 1.4.20 from Maven Central.","status":"published","published":"2026-10-12T19:53:32Z","modified":"2026-10-29T14:30:10.659583209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHSA-2025:2218","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:11Z","modified":"2026-10-09T10:15:30Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2219","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:11Z","modified":"2026-10-09T10:15:31Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2220","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:12Z","modified":"2026-10-09T10:15:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2221","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:12Z","modified":"2026-10-09T10:15:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2222","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:13Z","modified":"2026-10-09T10:15:33Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2223","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:13Z","modified":"2026-10-09T10:15:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-47072","title":"CVE-2024-47072 in io.root.com.thoughtworks.xstream:xstream - Patched by Root","description":"Root has patched CVE-2024-47072 in the io.root.com.thoughtworks.xstream:xstream package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-17T12:23:04Z","modified":"2026-06-17T18:15:15.265413236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2024-47072","description":"XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.","status":"published","published":"2024-11-08T00:15:00Z","modified":"2026-10-17T12:56:45.440689447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"CLSA-2026-1784250511","title":"TuxCare security update for com.thoughtworks.xstream:xstream (2 CVEs)","description":"TuxCare rebuilt com.thoughtworks.xstream:xstream to address 2 CVEs. Fixed in 1.4.17-tuxcare.2.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:46.552784835Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"DLA-4001-1","title":"libxstream-java - security update","status":"published","published":"2024-12-21T00:00:00Z","modified":"2026-03-09T01:23:04.4796Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:14480-1","title":"xstream-1.4.21-1.1 on GA media","description":"These are all security issues fixed in the xstream-1.4.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-08T00:00:00Z","modified":"2026-02-04T04:08:33.000631Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:4037-1","title":"Security update for bea-stax, xstream","description":"This update for bea-stax, xstream fixes the following issues:\n\n- CVE-2024-47072: Fixed possible remote denial-of-service via a stack overflow (bsc#1233085).\n","status":"published","published":"2024-11-19T08:48:56Z","modified":"2026-02-04T04:07:57.234207Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}