A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash.

The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist.

References:

http://seclists.org/oss-sec/2017/q2/9