CVE-2024-47072

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-470739.1DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In CVE-2024-470749.8DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customi CVE-2024-470756.1LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to CVE-2024-470768.6CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` p CVE-2024-470776.5authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stole CVE-2024-470789.8Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a sh CVE-2024-470796.4Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an CVE-2024-47089.8mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.CVE-2024-470808.7matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the m CVE-2024-470815.3Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for s CVE-2024-470828.0Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL CVE-2024-470837.5Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an is