PatchTheCVECVE-2020-26258: XStream is a Java library to serialize objects to XML and back again
CVE-2020-26258 is a medium-severity flaw (CVSS 6.3) affecting struts, xstream, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at leas
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 81.8% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2020-12-16 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: XStream <1.4.15 - Server-Side Request Forgery
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-26258?
struts: upgrade to 6.0.0; xstream: upgrade to 1.4.15; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-26258 being exploited?
CVE-2020-26258 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-26258 affect?
CVE-2020-26258 affects struts, xstream, debian linux. Severity is medium (CVSS 6.3). XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to reques
How urgent is CVE-2020-26258?
Priority 57/100. EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist
Software pages
Apache Struts vulnerabilities · Java vulnerabilities · Debian vulnerabilities
Related CVEs
- CVE-2025-66675 HIGH 8.2 UPGRADE Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaus
- CVE-2026-104714 HIGH 8.8 UPGRADE Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in A
- CVE-2026-104713 MEDIUM 6.5 UPGRADE Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
- CVE-2026-104712 HIGH 7.5 UPGRADE Asymmetric resource consumption (amplification) vulnerability in Apache Struts
- CVE-2026-104711 CRITICAL 9.8 UPGRADE Improper neutralization of special elements used in an expression language statement ('Expression Language Inj