{"id":"CVE-2022-40152","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-40152","generatedAt":"2026-11-04T23:59:57.948Z","title":"Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.","description":"Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","published":"2022-09-16T10:15:10.000Z","lastModified":"2026-06-17T05:01:03.000Z","status":"Analyzed","sourceIdentifier":"cve-coordination@google.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-121","CWE-787"],"affected":["xstream/xstream","fasterxml/woodstox"],"epss":{"score":0.18215,"percentile":0.97215,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 18.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434","tags":["Exploit","Permissions Required","Third Party Advisory"],"source":"cve-coordination@google.com"},{"url":"https://github.com/x-stream/xstream/issues/304","tags":["Issue Tracking","Third Party Advisory"],"source":"cve-coordination@google.com"},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434","tags":["Exploit","Permissions Required","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/x-stream/xstream/issues/304","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}