-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.thoughtworks.xstream:xstream | maven | < 1.4.20 | 1.4.20 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled recursion during XML unmarshalling of deeply nested structures. The TreeUnmarshaller.startElement method is responsible for processing nested elements recursively. Pre-1.4.20 versions lacked depth tracking in this critical path, allowing attackers to craft malicious payloads that exhaust the call stack. The patch in 1.4.20 introduced depth validation in this unmarshalling process, confirming this as the vulnerable code path.
Ongoing coverage of React2Shell