CVE-2017-7957: Debian Linux

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Red Hat Fuse: version 1.0 only
• Red Hat JBoss Middleware: version 1 only
• XStream XStream: up to and including 1.4.9

Published 2017-04-29. Last modified 2026-10-08.