---
id: CVE-2016-3674
title: >-
  Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2)
  DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6)
  StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow
  remote attackers…
summary: >-
  Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2)
  DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6)
  StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow
  remote attackers…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
vendor: redhat
product: jboss_middleware
affected:
  - jboss_middleware = 1
  - debian_linux = 8.0
  - fedora = 22
  - fedora = 23
  - xstream < 1.4.9
patched:
  - xstream 1.4.9
published: '2016-05-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:05.023'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-3674'
references:
  - url: >-
      http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
    label: cve@mitre.org
  - url: >-
      http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
    label: cve@mitre.org
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2822.html'
    label: cve@mitre.org
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2823.html'
    label: cve@mitre.org
  - url: 'http://www.debian.org/security/2016/dsa-3575'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2016/03/25/8'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2016/03/28/1'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/85381'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id/1036419'
    label: cve@mitre.org
  - url: 'http://x-stream.github.io/changes.html#1.4.9'
    label: cve@mitre.org
  - url: 'https://github.com/x-stream/xstream/issues/25'
    label: cve@mitre.org
  - url: >-
      http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2822.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2823.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.debian.org/security/2016/dsa-3575'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2016/03/25/8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2016/03/28/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/85381'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1036419'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://x-stream.github.io/changes.html#1.4.9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/x-stream/xstream/issues/25'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.08179
epssPercentile: 0.94836
ingestedAt: '2026-10-08T22:11:53.689Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-08T20:54:55.618129Z'
---

## Overview

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

## Affected

- `jboss_middleware = 1`
- `debian_linux = 8.0`
- `fedora = 22`
- `fedora = 23`
- `xstream < 1.4.9`

## Remediation

Upgrade past the affected range:

- `xstream 1.4.9`