Live › vulnerability › CVE-2021-39144
Go to dashboardXStream, a Java library for serializing objects to XML, can be tricked into deserializing attacker-supplied input that replaces or injects objects. An attacker who sends crafted XML to an affected application can run a local command on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| XStream XStream | vendor | – | – |
| xstream | vendor | < 1.4.18 | 1.4.18 |
| debian linux | vendor | = 9.0 | – |
| debian linux | vendor | = 10.0 | – |
| debian linux | vendor | = 11.0 | – |
| fedoraproject fedora | vendor | = 33 | – |
| fedoraproject fedora | vendor | = 34 | – |
| fedoraproject fedora | vendor | = 35 | – |
| netapp snapmanager | vendor | – | – |
| oracle business activity monitoring | vendor | = 12.2.1.4.0 | – |
| oracle commerce guided search | vendor | = 11.3.2 | – |
| oracle communications billing and revenue management elastic charging engine | vendor | = 11.3 | – |
| oracle communications billing and revenue management elastic charging engine | vendor | = 12.0 | – |
| oracle communications cloud native core automated test suite | vendor | = 1.9.0 | – |
| oracle communications cloud native core binding support function | vendor | = 1.10.0 | – |
| oracle communications cloud native core policy | vendor | = 1.14.0 | – |
| oracle communications unified inventory management | vendor | = 7.3.4 | – |
| oracle communications unified inventory management | vendor | = 7.3.5 | – |
| oracle communications unified inventory management | vendor | = 7.4.0 | – |
| oracle communications unified inventory management | vendor | = 7.4.1 | – |
| oracle communications unified inventory management | vendor | = 7.4.2 | – |
| oracle retail xstore point of service | vendor | = 16.0.6 | – |
| oracle retail xstore point of service | vendor | = 17.0.4 | – |
| oracle retail xstore point of service | vendor | = 18.0.3 | – |
| oracle retail xstore point of service | vendor | = 19.0.2 | – |
| oracle retail xstore point of service | vendor | = 20.0.1 | – |
| oracle utilities framework | vendor | = 4.2.0.2.0 | – |
| oracle utilities framework | vendor | = 4.2.0.3.0 | – |
| oracle utilities framework | vendor | = 4.3.0.1.0 | – |
| oracle utilities framework | vendor | = 4.3.0.6.0 | – |
| oracle utilities framework | vendor | = 4.4.0.0.0 | – |
| oracle utilities framework | vendor | = 4.4.0.2.0 | – |
| oracle utilities framework | vendor | = 4.4.0.3.0 | – |
| oracle utilities testing accelerator | vendor | = 6.0.0.1.1 | – |
| oracle webcenter portal | vendor | = 12.2.1.3.0 | – |
| oracle webcenter portal | vendor | = 12.2.1.4.0 | – |
Find XStream in your dependencies (for example, search pom.xml, build.gradle or the packaged JAR for com.thoughtworks.xstream) and check the version against the advisory.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
This page as .md · .json · in your agent: get_signal("CVE-2021-39144")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.