XStream can cause a Denial of Service

Vulnerability

XStream versions up to and including 1.4.17 are affected by a denial-of-service vulnerability. The bug occurs during unmarshalling when type information in the input stream can be manipulated to create objects that cause an endless loop, consuming 100% CPU time. Users who have followed the recommendation to set up XStream's security framework with a whitelist of minimal required types are not affected. [1][2]

Exploitation

An attacker can send a specially crafted XML (or other supported format like JSON) to an application that uses XStream without proper security configuration. The provided proof-of-concept demonstrates using a linked-hash-set with embedded AnnotationInvocationHandler and SimpleBindings to create a self-referential structure that triggers an infinite loop upon unmarshalling. No authentication or special network position is required; only the ability to deliver the malicious input stream. [2]

Impact

Successful exploitation results in a denial of service: the target thread enters an endless loop, consuming 100% CPU time indefinitely. Depending on CPU type or parallel execution, the system may become unresponsive. The attacker cannot execute arbitrary code or access data; the impact is limited to availability degradation. [1][2]

Mitigation

XStream 1.4.18, released August 2021, addresses this vulnerability by no longer using a blacklist by default; instead, it requires a whitelist of allowed types. Users are advised to upgrade to version 1.4.18 or later and to configure the security framework with a whitelist of minimal required types. No other workarounds are available. [1][2]