{"id":"CVE-2017-7957","title":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fro…","summary":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fro…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-20"],"vendor":"redhat","product":"fuse","affected":["fuse = 1.0","jboss_middleware = 1","xstream <= 1.4.9","debian_linux = 8.0","debian_linux = 9.0"],"published":"2017-04-29","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:05.933","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-7957","references":[{"url":"http://www.debian.org/security/2017/dsa-3841","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/100687","label":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id/1039499","label":"cve@mitre.org"},{"url":"http://x-stream.github.io/CVE-2017-7957.html","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:1832","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2888","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:2889","label":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/125800","label":"cve@mitre.org"},{"url":"https://www-prd-trops.events.ibm.com/node/715749","label":"cve@mitre.org"},{"url":"http://www.debian.org/security/2017/dsa-3841","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/100687","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039499","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://x-stream.github.io/CVE-2017-7957.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:1832","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2888","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2889","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/125800","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www-prd-trops.events.ibm.com/node/715749","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.04928,"epssPercentile":0.92086,"ingestedAt":"2026-10-08T22:11:53.691Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T20:54:48.322148Z"},"slug":"CVE-2017-7957","body":"## Overview\n\nXStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"<void/>\") call.\n\n## Affected\n\n- `fuse = 1.0`\n- `jboss_middleware = 1`\n- `xstream <= 1.4.9`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}