medium 6.5

CVE-2022-40152 json

Stack Buffer Overflow in Woodstox

published 2022-09-16 4y ago modified 2026-09-10 last mo. also GHSA-3f7h-mf4q-vrm4 , EUVD-2022-6677

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 18.2%; EPSS 18.2% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Patch / fix

fixed in 2 distros 3 links 1

maven com.fasterxml.woodstox:woodstox-core 5.4.0, 6.4.0
xstream Woodstox 5.4.0, 6.4.0

red hat suse opensuse

eap7-woodstox-core jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 6.4.0-1.redhat_00001.1.el7eap
jenkins ocp tools 4.13 2.387.3.1684911776-3.el8
jenkins-2-plugins ocp tools 4.13 4.13.1684911916-1.el8
eap7-wildfly jboss enterprise application platform 7.4 7.4.9-4.GA_redhat_00003.1.el8eap
eap7-jettison jboss enterprise application platform 7.4 1.5.2-1.redhat_00002.1.el8eap
eap7-undertow jboss enterprise application platform 7.4 2.2.22-1.SP3_redhat_00001.1.el8eap
eap7-apache-sshd jboss enterprise application platform 7.4 2.9.2-1.redhat_00001.1.el8eap
eap7-elytron-web jboss enterprise application platform 7.4 1.9.3-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:4437 RHSA-2025:4226 RHSA-2023:3299 RHSA-2023:0553 RHSA-2023:0552 RHSA-2023:0554

woodstox Manager Server Module 4.3 4.4.2-150400.3.6.1
smdba Manager Server Module 4.2 1.7.11-0.150300.3.12.2
drools Manager Server Module 4.2 7.17.0-150300.4.9.2
rhnlib Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.7-150300.4.12.2
cobbler Manager Server Module 4.2 3.1.2-150300.5.19.1
mgr-osad Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.9-150300.2.12.2
spacecmd Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.21-150300.4.33.2
woodstox Manager Server Module 4.2 4.4.2-150300.3.6.2

suse advisories SUSE-SU-2023:0679-1 SUSE-SU-2023:0592-1

woodstox-core openSUSE Tumbleweed 7.2.1-1.1

opensuse advisories openSUSE-SU-2026:11226-1

github.com/FasterXML/woodstox#159 pull request

Is CVE-2022-40152 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-40152 updated 2026-11-05 cvss 7.5

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

Red Hat Migration Toolkit for Runtimes xstream
affected: no fix planned “Will not fix”
Red Hat build of Quarkus woodstox-core
affected: no fix available
Red Hat Data Grid 8 xstream
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 7 woodstox-core, woodstox-core-javadoc
affected: no fix planned “Out of support scope”
Red Hat Fuse 7 woodstox-core
affected: no fix planned “Will not fix”
Red Hat Integration Camel K 1 woodstox-core Red Hat Integration Camel Quarkus 1 woodstox-core
affected: no fix available
Red Hat JBoss Data Grid 7 woodstox-core Red Hat JBoss Data Virtualization 6 woodstox-core Red Hat JBoss Enterprise Application Platform 6 woodstox-core Red Hat JBoss Fuse 6 woodstox-core Red Hat JBoss Fuse Service Works 6 woodstox-core
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 jenkins
affected: no fix available

show 15 more

Red Hat OpenStack Platform 13 (Queens) opendaylight
affected: no fix planned “Out of support scope”
Red Hat Satellite 6 woodstox-core
affected: no fix planned “Will not fix”
Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.387.3.1684911776-3.el8
fixed: vendor fix RHSA-2023:3299
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap
fixed: vendor fix RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap
fixed: vendor fix RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el9eap
fixed: vendor fix RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7, eap7-wildfly 7.1.10-2.GA_redhat_00002.1.ep7.el7, eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7, eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7, eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7, eap7-artemis-native 1.5.5.016-1.redhat_00001.1.ep7.el7, +19 more
fixed: vendor fix RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-gson 2.8.9-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.13-4.GA_redhat_00002.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, eap7-activemq-artemis 2.9.0-10.redhat_00021.1.el7eap, eap7-hal-console 3.2.18-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.13-4.GA_redhat_00002.1.el7eap, +41 more
fixed: vendor fix RHSA-2025:4437
Red Hat JBoss Enterprise Application Platform 7.4.9 woodstox-core 6.4.0.redhat-00001
fixed: vendor fix RHSA-2023:0556
Red Hat RHINT Camel-Q 2.13.2
fixed: vendor fix RHSA-2023:0469
Red Hat RHINT Camel-Springboot 3.18.3.P2
fixed: vendor fix RHSA-2023:3641
Red Hat RHINT Camel-Springboot 3.20.1
fixed: vendor fix RHSA-2023:2100
Red Hat RHINT Service Registry 2.4.3 GA
fixed: vendor fix RHSA-2023:3815
Red Hat RHPAM 7.13.4 async
fixed: vendor fix RHSA-2023:4983
Red Hat A-MQ Clients 2 woodstox-core Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1684911916-1.el8 Red Hat AMQ Broker 7 woodstox-core Red Hat build of Debezium 1 woodstox-core Red Hat Data Grid 8 woodstox-core

+7 more productsfewer

Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el8eap, +40 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el9eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el9eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el9eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el9eap, +40 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1535 more Red Hat JBoss Enterprise Application Platform Expansion Pack woodstox-core Red Hat OpenShift Application Runtimes woodstox-core Red Hat Single Sign-On 7 woodstox-core

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: last yr. (2025-04-21)

Exploit prediction

18.22% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	com.fasterxml.woodstox:woodstox-core	>=6.0.0, <6.4.0 <5.4.0	6.4.0 5.4.0

Affected products

xstream Woodstox

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

github.com /FasterXML/woodstox/pull/159
web
bugs.chromium.org /p/oss-fuzz/issues/detail?id=47434
web, exploit, permissions-required, third-party-advisory
github.com /x-stream/xstream/issues/304
web, issue-tracking, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-40152
advisory
github.com /FasterXML/woodstox/issues/157
web
github.com /FasterXML/woodstox/issues/160
web
github.com /FasterXML/woodstox
package

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.