CVE-2022-40151: Stack Buffer Overflow in xstream
A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization.
Other sources
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
XStream is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially-crafted XML data, a remote authenticated attacker could exploit this vulnerability to causes the parser to crash, and results in a denial of service condition.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-40151?
CVE-2022-40151 is a vulnerability in the XStream package that allows an attacker to cause a denial of service (DOS) attack by crashing the parser with stack overflow.
Who is affected by CVE-2022-40151?
Users of XStream who are running the vulnerable version of the software are affected by CVE-2022-40151.
What is the severity of CVE-2022-40151?
CVE-2022-40151 has a severity rating of high.
How can an attacker exploit CVE-2022-40151?
An attacker can exploit CVE-2022-40151 by supplying content to the XStream parser that causes it to crash with a stack overflow, resulting in a denial of service attack.
How can I protect myself from CVE-2022-40151?
To protect yourself from CVE-2022-40151, update XStream to version 2.387.3.1684911776-3.el8 or later, as provided by Red Hat.