Thank you Salvatore. Here is the upstream commit that has to be backported:
https://github.com/x-stream/xstream/commit/b3570be Emmanuel Bourg __ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.

