CVE catalog

CVE-2022-40151

libxstream-java affected and fixed versions

[CVE catalog]

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.22% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Opensusetumbleweedxstream1.4.20-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12796-1]
Debiantrixielibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debiantrixielibxstream-java1.4.21-1Affected[CVE-2022-40151]
Debiansidlibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debiansidlibxstream-java1.4.21-2Affected[CVE-2022-40151]
Susemanager server module 4.3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Susemanager server module 4.2xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server for sap applications 15 sp3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server for sap applications 15 sp2xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server 15 sp3-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server 15 sp2-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise real time 15 sp3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]

Showing 12 observations. All 24 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedlibxstream-javaNot reportedUnknownSource applicability is not establishedProvider not reported
Debianbookwormlibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debianbookwormlibxstream-java1.4.20-1+deb12u1Affected[CVE-2022-40151]
Debianforkylibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debianforkylibxstream-java1.4.21-2Affected[CVE-2022-40151]
Debiansidlibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debiansidlibxstream-java1.4.21-2Affected[CVE-2022-40151]
Debiantrixielibxstream-javaNot reportedAffectedDistribution reports no fix[CVE-2022-40151]
Debiantrixielibxstream-java1.4.21-1Affected[CVE-2022-40151]
Opensuseleap 15.4xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Opensusetumbleweedxstream1.4.20-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12796-1]
Suseenterprise storage 7xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suseenterprise storage 7.1xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise high performance computing 15 sp2-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise high performance computing 15 sp3-esposxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise high performance computing 15 sp3-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise module for development tools 15 sp4xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise real time 15 sp3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server 15 sp2-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server 15 sp3-ltssxstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server for sap applications 15 sp2xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Suselinux enterprise server for sap applications 15 sp3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Susemanager server module 4.2xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Susemanager server module 4.3xstream1.4.20-150200.3.25.1UnknownSource applicability is not established[SUSE-SU-2023:1673-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "libxstream-java",
      "status": "vulnerable",
      "release": "sid",
      "version": "1.4.21-2"
    },
    {
      "name": "libxstream-java",
      "status": "vulnerable",
      "release": "forky",
      "version": "1.4.21-2"
    },
    {
      "name": "libxstream-java",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.4.21-1"
    },
    {
      "name": "libxstream-java",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.4.20-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "libxstream-java",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "manager server module 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "manager server module 4.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp3-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp3-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise real time 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp3-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-150200.3.25.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:1673-1",
      "fixed_version": "1.4.20-150200.3.25.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:1673-1",
      "provider_updated_at": "2026-02-04T03:30:00.436104Z",
      "applicability_unknown": true
    },
    {
      "name": "xstream",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.20-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12796-1",
      "fixed_version": "1.4.20-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12796-1",
      "provider_updated_at": "2026-02-04T03:23:25.586938Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxstream-java]Unknown
    Details (2)

    • 1.4.20-1+deb12u1 · all · bookworm

      Affected

      dsa · libxstream-java · debian · bookworm

    • 1.4.20-1+deb12u1 · all · bookworm

      Affected

      dsa · libxstream-java · debian · bookworm

[openSUSE Tumbleweed]

  • [xstream]Unknown

    Source package: [xstream]

    Details (1)

    • 1.4.21-1.7 · noarch · tumbleweed

      Fixed · Fixed: 1.4.20-1.1

      dsa · xstream · opensuse · tumbleweed

  • [xstream-benchmark]Unknown

    Source package: [xstream]

    Details (1)

    • 1.4.21-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.4.20-1.1

      Version impact unknown

      dsa · xstream · opensuse · tumbleweed

  • [xstream-javadoc]Unknown

    Source package: [xstream]

    Details (1)

    • 1.4.21-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.4.20-1.1

      Version impact unknown

      dsa · xstream · opensuse · tumbleweed

  • [xstream-parent]Unknown

    Source package: [xstream]

    Details (1)

    • 1.4.21-1.7 · noarch · tumbleweed

      Unknown · Fixed: 1.4.20-1.1

      Version impact unknown

      dsa · xstream · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]