CVE-2022-40152 Stack Buffer Overflow in Woodstox
An attacker can cause a denial of service via stack overflow in Woodstox XML parser when DTD support is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40152?
CVE-2022-40152 is a medium-severity denial of service vulnerability in xstream Woodstox, published on 16 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Which versions are affected by CVE-2022-40152?
4 open source packages ship an affected version, including com.fasterxml.woodstox:woodstox-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.woodstox:woodstox-core Maven | All versions | 5.4.0 |
com.fasterxml.woodstox:woodstox-core Maven | All versions | 5.4.0 |
com.fasterxml.woodstox:woodstox-core Maven | From 6.0.0 | 6.4.0 |
com.fasterxml.woodstox:woodstox-core Maven | From 6.0.0 | 6.4.0 |
Linux distribution packages (2)
woodstox SUSE:Manager Server Module 4.3 | All versions | 4.4.2-150400.3.6.1 |
woodstox-core openSUSE:Tumbleweed | All versions | 7.2.1-1.1 |
Products include Fasterxml Woodstox, Xstream Xstream.
How do I fix CVE-2022-40152?
Upgrade com.fasterxml.woodstox:woodstox-core to a fixed version for your release line: 5.4.0 or 6.4.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-40152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40152 exists.
Sources
Also known as CLEANSTART-2026-PV59376, CLEANSTART-2026-VM58824, CLSA-2024-1733443231, CLSA-2026-1773101686, CLSA-2026-1793138767, DEBIAN-CVE-2022-40152 and 14 more.