CVE-2022-40151: Stack Buffer Overflow in xstream

Vulnerability summary

CVE-2022-40151 is a high (CVSS 7.5) Stack-based Buffer Overflow vulnerability in xstream. EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-09-2022
   PublishedVulnerability first disclosed.
2. 21-04-2025
   Last modifiedVulnerability information updated.

Description

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

• CWE-121Stack-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the stack.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.