CVE-2017-7957

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

• CWE-20

• http://www.debian.org/security/2017/dsa-3841Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/100687Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039499Broken Link, Third Party Advisory, VDB Entry
• http://x-stream.github.io/CVE-2017-7957.htmlVendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1832Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2888Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2889Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125800Third Party Advisory, VDB Entry
• https://www-prd-trops.events.ibm.com/node/715749Broken Link, Permissions Required
• http://www.debian.org/security/2017/dsa-3841Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/100687Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039499Broken Link, Third Party Advisory, VDB Entry
• http://x-stream.github.io/CVE-2017-7957.htmlVendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1832Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2888Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2889Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125800Third Party Advisory, VDB Entry
• https://www-prd-trops.events.ibm.com/node/715749Broken Link, Permissions Required

Published

Apr 29, 2017

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7947NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, …
• CVE-2017-7948Integer overflow in the mark_curve function in Artifex Ghost…
• CVE-2017-7950Nitro Pro 11.0.3 and earlier allows remote attackers to caus…
• CVE-2017-7951WonderCMS before 2.0.3 has CSRF because of lack of a token i…
• CVE-2017-7952INFOR EAM V11.0 Build 201410 has SQL injection via search fi…
• CVE-2017-7953INFOR EAM V11.0 Build 201410 has XSS via comment fields.
• CVE-2017-7960The cr_input_new_from_uri function in cr-input.c in libcroco…
• CVE-2017-7961The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.…7.8
• CVE-2017-7962The iwgif_read_image function in imagew-gif.c in libimagewor…
• CVE-2017-7963The GNU Multiple Precision Arithmetic Library (GMP) interfac…
• CVE-2017-7964Zyxel WRE6505 devices have a default TELNET password of 1234…
• CVE-2017-7965A buffer overflow vulnerability exists in Programming Softwa…7.3