What’s Vulnerable › Vulnerabilities
CVE-2021-39144: XStream Remote Code Execution Vulnerability
- Severity: high (CVSS 8.5 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2023-03-10
- EPSS: 98.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-08-23 · updated 2026-06-17
- Weakness: CWE-94
Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected products
- Debian Linux: 9.0, 10.0, 11.0
- Fedoraproject Fedora: 33, 34, 35
- SnapManager for Oracle: all versions
- Oracle Business Activity Monitoring: 12.2.1.4.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3, 12.0
- Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0
- Oracle Communications Cloud Native Core Binding Support Function: 1.10.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
- Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
- Oracle Corporation Utilities Framework: 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 (+1)
- Oracle Utilities Testing Accelerator: 6.0.0.1.1
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- x-stream xstream: before 1.4.18 — fixed in 1.4.18
How to fix
Upgrade to a fixed version: x-stream xstream 1.4.18. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
- https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://security.netapp.com/advisory/ntap-20210923-0003/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://x-stream.github.io/CVE-2021-39144.html
Get alerted when CVE-2021-39144 or the next vulnerability affects your stack