CVE-2017-7957
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-25)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- redhat:fuse
- redhat:jboss_middleware
- xstream:xstream
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7hwc-46rm-65jh | Maven | com.thoughtworks.xstream:xstream | <1.4.10 | 1.4.10 |