What’s Vulnerable › Vulnerabilities
CVE-2021-39153: XStream is vulnerable to an Arbitrary Code Execution attack
- Severity: high (CVSS 8.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-08-23 · updated 2026-10-07
- Weakness: CWE-434
Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected products
- Debian Linux: 9.0, 10.0, 11.0
- Fedoraproject Fedora: 33, 34, 35
- SnapManager for Oracle: all versions
- Oracle Business Activity Monitoring: 12.2.1.4.0
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3, 12.0
- Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0
- Oracle Communications Cloud Native Core Binding Support Function: 1.10.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
- Oracle Corporation Utilities Framework: 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 (+1)
- Oracle Utilities Testing Accelerator: 6.0.0.1.1
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- x-stream xstream: before 1.4.18 — fixed in 1.4.18
How to fix
Upgrade to a fixed version: x-stream xstream 1.4.18. Check the vendor advisory for mitigations.
References
- https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v
- https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://security.netapp.com/advisory/ntap-20210923-0003/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://x-stream.github.io/CVE-2021-39153.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v
Get alerted when CVE-2021-39153 or the next vulnerability affects your stack