master: 
v-1.4.x: 
Java to XML Serialization, and back again
All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the performance of XStream.
Documentation can be found at GitHub. This includes:
The complete source for XStream is bundled in the -src archive. This includes:
- Main API [xstream/src/java]
- Unit Tests [xstream/src/test]
- Maven Build Files [pom.xml]
- Hibernate Module [xstream-hibernate]
- Website [xstream-distribution]
This is trunk of the XStream repo at https://github.com/x-stream/xstream as of 9/20/22. It includes the patches from pull request x-stream#299 which the original report https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858 says fixed https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40151 .
I've also made changes to DefaultDriver.java to switch the default XML parser back to Xpp3, to make the change as minimal as possible.