{"action":"Upgrade com.thoughtworks.xstream:xstream to 1.4.11 or later.","affected":[{"fixed":"1.4.11","introduced":"1.4.10"}],"component":"com.thoughtworks.xstream:xstream","cve_ids":["CVE-2019-10173"],"ecosystem":"Maven","epss":0.95036,"exploited":false,"fixed_versions":["1.4.11"],"ghsa_id":"GHSA-hf23-9pf7-388p","id":"tcs_01M5N90CEF1JC39FF2C4JP0G3G","modified_at":"2026-09-10T03:47:54.196537853Z","published_at":"2019-07-26T16:09:47Z","references":["https://osv.dev/vulnerability/GHSA-hf23-9pf7-388p","https://nvd.nist.gov/vuln/detail/CVE-2019-10173","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0445","https://access.redhat.com/errata/RHSA-2020:0727","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173","https://github.com/x-stream/xstream","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","http://x-stream.github.io/changes.html#1.4.11"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hf23-9pf7-388p","url":"https://osv.dev/vulnerability/GHSA-hf23-9pf7-388p"}],"summary":"Deserialization of Untrusted Data and Code Injection in xstream"}