CVE-2022-40151

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

VendorProductVersions
xstreamxstream>= unspecified, <= 1.4.19

References

Timeline

Published
Sep 16, 2022
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-401527.5Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is runnCVE-2022-401596.5** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is inCVE-2022-40166.5The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCVE-2022-401606.5** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is inCVE-2022-40178.8The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCVE-2022-401768.0A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DCVE-2022-401775.7A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DCVE-2022-401785.4A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DCVE-2022-401798.1A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DCVE-2022-40184.3Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-401805.3A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DCVE-2022-401818.3A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D
CVE-2022-40151: High severity, CVSS 7.5 | Vulnix