Vulnerability record · CVE-2020-26258 · published 16 December 2020
CVE-2020-26258: XStream XML unmarshalling SSRF via default blacklist
Apache · Struts
XStream before 1.4.15 allows server-side request forgery when unmarshalling XML, letting a crafted input stream trigger requests to internal resources. It matters because applications that rely on XStream's default blacklist rather than a whitelist are exposed, and the flaw does not exist on Java 15 or higher.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Automated analysis
high priorityHigh CVSS (7.7) and very high EPSS with public exploit material, though exploitation requires low privileges and is mitigated by whitelist configuration or Java 15+.
What it is
XStream before 1.4.15 allows server-side request forgery when unmarshalling XML, letting a crafted input stream trigger requests to internal resources. It matters because applications that rely on XStream's default blacklist rather than a whitelist are exposed, and the flaw does not exist on Java 15 or higher.
Impact
An attacker can make the server issue requests to internal, non-public resources and read the responses, exposing internal services and data. The CVSS vector rates confidentiality impact as high with no integrity or availability impact.
Attack surface
Reached remotely over the network by manipulating the XML input stream processed by XStream; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.81817, 99.6th percentile) and the vendor advisory is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade XStream to 1.4.15 or later.
- Configure XStream's Security Framework with a whitelist of allowed types instead of relying on the default blacklist.
- If 1.4.14 or below must be kept with the default blacklist, apply the workaround in the vendor advisories.
- Run on Java 15 or higher where the reported vulnerability does not exist.
- Update dependent distributions and products (Debian, Fedora, Apache Struts, NetApp) to patched versions.
Detection
- Monitor application logs for XStream unmarshalling errors or unexpected class processing around XML input.
- Watch for outbound requests from application servers to internal or link-local addresses that are not part of normal traffic.
- Alert on XML payloads containing unexpected type or class references submitted to XStream endpoints.
- Track XStream library versions in deployed applications and flag any below 1.4.15.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-26258 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-26258), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
