Could you please investigate if Confluence uses XStream and what for?
I found here that Confluence is referenced as a XStream user.
Thank you.
From quickly running grep -rnw 'confluence-project/' -e 'xstream' on the source code it looks like Confluence mostly uses it for Bandana. If you want to have a look at the source code yourself you can buy a $10 license and download the source code from my.atlassian.com. 