Chainx-stream · xstreamMaven:com.thoughtworks.xstream:xstream
x-stream xstream: regressions (2017–2024)
6 CVEs over 4 generations, 29 Apr 2017 to 7 Nov 2024.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2017-795729 Apr 2017 First in the chain
- CVE-2013-728515 May 2019 related to CVE-2017-7957
- CVE-2019-1017323 Jul 2019 regression of CVE-2013-7285
- CVE-2020-2621716 Nov 2020 related to CVE-2017-7957next fix after CVE-2019-10173
- CVE-2021-438591 Feb 2022 related to CVE-2017-7957related to CVE-2013-7285
- CVE-2024-470727 Nov 2024 related to CVE-2021-43859
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2017-7957 | 29 Apr 2017 | XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of… · fixed in 1.4.10 | First in chain | 18.4 |
| CVE-2013-7285 | 15 May 2019 | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a… · fixed in 1.4.11 | CVE-2017-7957 · related · Medium | 24.9 |
| CVE-2019-10173 | 23 Jul 2019 | It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw · fixed in 1.4.11 | CVE-2013-7285 · regression of · High | 25.1 |
| CVE-2020-26217 | 16 Nov 2020 | Remote Code Execution in XStream · fixed in 1.4.14-java7 | CVE-2017-7957 · related · Medium | 30.5 |
| CVE-2021-43859 | 1 Feb 2022 | Denial of Service by injecting highly recursive collections or maps in XStream · fixed in 1.4.19 | CVE-2017-7957 · related · Medium | 24.2 |
| CVE-2024-47072 | 7 Nov 2024 | XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream · fixed in 1.4.21 | CVE-2021-43859 · related · Medium | 21.4 |