{"action":"Upgrade com.thoughtworks.xstream:xstream to 1.4.9 or later.","affected":[{"fixed":"1.4.9","introduced":"0"}],"component":"com.thoughtworks.xstream:xstream","cve_ids":["CVE-2016-3674"],"ecosystem":"Maven","epss":0.08179,"exploited":false,"fixed_versions":["1.4.9"],"ghsa_id":"GHSA-rgh3-987h-wpmw","id":"tcs_01M5N9BTEB9CZDZ6TZ712WZ9J1","modified_at":"2025-05-23T19:46:42.534904Z","published_at":"2020-06-30T22:48:14Z","references":["https://osv.dev/vulnerability/GHSA-rgh3-987h-wpmw","https://nvd.nist.gov/vuln/detail/CVE-2016-3674","https://github.com/x-stream/xstream/issues/25","https://github.com/x-stream/xstream","https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385","http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html","http://rhn.redhat.com/errata/RHSA-2016-2822.html","http://rhn.redhat.com/errata/RHSA-2016-2823.html","http://www.debian.org/security/2016/dsa-3575","http://www.openwall.com/lists/oss-security/2016/03/25/8","http://www.openwall.com/lists/oss-security/2016/03/28/1","http://www.securityfocus.com/bid/85381","http://www.securitytracker.com/id/1036419","http://x-stream.github.io/changes.html#1.4.9"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-rgh3-987h-wpmw","url":"https://osv.dev/vulnerability/GHSA-rgh3-987h-wpmw"}],"summary":"XML External Entity Injection in XStream"}