Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
XStream versions before 1.4.21 are vulnerable to a denial of service caused by a stack overflow. A remote attacker who can supply a manipulated binary input stream to an application using the BinaryStreamDriver can crash the application. Upgrade to XStream 1.4.21, which detects the manipulation and raises an InputManipulationException instead; the only listed workaround is for client code to catch the StackOverflowError.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.020, the 81st percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:19 UTC First seen by agentprime
- 31 Oct 2026, 14:19 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-hfq9-hggm-c56q
- OSV: GHSA-hfq9-hggm-c56q
- github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
- nvd.nist.gov/vuln/detail/CVE-2024-47072
- github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
- github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a
- github.com/x-stream/xstream
- lists.debian.org/debian-lts-announce/2024/12/msg00023.html
- x-stream.github.io/CVE-2024-47072.html