{"id":"CVE-2021-39144","kind":"vulnerability","aliases":["CVE-2021-39144"],"related":[],"title":"XStream is a simple library to serialize objects to XML and back again","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","summary":"XStream, a Java library for serializing objects to XML, can be tricked into deserializing attacker-supplied input that replaces or injects objects. An attacker who sends crafted XML to an affected application can run a local command on the server.","severity":"critical","cvss":8.5,"epss":null,"exploited":true,"exploited_at":"2023-03-10T00:00:00+00:00","products":[{"name":"XStream XStream","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"xstream","fixed":["1.4.18"],"affected":"< 1.4.18","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 33","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 34","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 35","ecosystem":"vendor"},{"name":"netapp snapmanager","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"oracle business activity monitoring","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"},{"name":"oracle commerce guided search","fixed":[],"affected":"= 11.3.2","ecosystem":"vendor"},{"name":"oracle communications billing and revenue management elastic charging engine","fixed":[],"affected":"= 11.3","ecosystem":"vendor"},{"name":"oracle communications billing and revenue management elastic charging engine","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core automated test suite","fixed":[],"affected":"= 1.9.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core binding support function","fixed":[],"affected":"= 1.10.0","ecosystem":"vendor"},{"name":"oracle communications cloud native core policy","fixed":[],"affected":"= 1.14.0","ecosystem":"vendor"},{"name":"oracle communications unified inventory management","fixed":[],"affected":"= 7.3.4","ecosystem":"vendor"},{"name":"oracle communications unified inventory management","fixed":[],"affected":"= 7.3.5","ecosystem":"vendor"},{"name":"oracle communications unified inventory management","fixed":[],"affected":"= 7.4.0","ecosystem":"vendor"},{"name":"oracle communications unified inventory management","fixed":[],"affected":"= 7.4.1","ecosystem":"vendor"},{"name":"oracle communications unified inventory management","fixed":[],"affected":"= 7.4.2","ecosystem":"vendor"},{"name":"oracle retail xstore point of service","fixed":[],"affected":"= 16.0.6","ecosystem":"vendor"},{"name":"oracle retail xstore point of service","fixed":[],"affected":"= 17.0.4","ecosystem":"vendor"},{"name":"oracle retail xstore point of service","fixed":[],"affected":"= 18.0.3","ecosystem":"vendor"},{"name":"oracle retail xstore point of service","fixed":[],"affected":"= 19.0.2","ecosystem":"vendor"},{"name":"oracle retail xstore point of service","fixed":[],"affected":"= 20.0.1","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.2.0.2.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.2.0.3.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.3.0.1.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.3.0.6.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.4.0.0.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.4.0.2.0","ecosystem":"vendor"},{"name":"oracle utilities framework","fixed":[],"affected":"= 4.4.0.3.0","ecosystem":"vendor"},{"name":"oracle utilities testing accelerator","fixed":[],"affected":"= 6.0.0.1.1","ecosystem":"vendor"},{"name":"oracle webcenter portal","fixed":[],"affected":"= 12.2.1.3.0","ecosystem":"vendor"},{"name":"oracle webcenter portal","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","package","vmware-cloud-foundation","xstream"],"not_affected_if":["no-xstream-dependency"],"how_to_check":"Find XStream in your dependencies (for example, search pom.xml, build.gradle or the packaged JAR for com.thoughtworks.xstream) and check the version against the advisory.","fix":"Upgrade XStream to a version that fixes CVE-2021-39144 per the vendor instructions referenced by CISA; the exact fixed version is not in the sources.\nIf the affected products are VMware Cloud Foundation or similar, apply the vendor's update.","status":"open","published_at":"2021-08-23T18:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:35+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:08:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade XStream to a version that fixes CVE-2021-39144 per the vendor instructions referenced by CISA; the exact fixed version is not in the sources.\nIf the affected products are VMware Cloud Foundation or similar, apply the vendor's update.","reach":"network","impact":"high","summary":"XStream, a Java library for serializing objects to XML, can be tricked into deserializing attacker-supplied input that replaces or injects objects. An attacker who sends crafted XML to an affected application can run a local command on the server.","category":"package","who_cares":["java","xstream","vmware-cloud-foundation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs local commands on the server through crafted XML input","analyst_note":"Get the fixed XStream version and the exact affected version range from the CISA KEV entry and the XStream security advisory; confirm which default configurations are exposed.","how_to_check":"Find XStream in your dependencies (for example, search pom.xml, build.gradle or the packaged JAR for com.thoughtworks.xstream) and check the version against the advisory.\nunknown","needs_analyst":true,"not_affected_if":["no-xstream-dependency"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000511,"input_tokens":2817,"output_tokens":459,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':14A,17A '-39144':15A,18A '1.4.18':282C 'accelerator':163A 'activity':38A 'affect':209B,233C,261C 'allow':238C 'and':47A,56A 'applic':210B 'attack':193B,202B,241C 'attacker-suppli':192B 'automated':67A 'back':12A,230C 'billing':46A,55A 'binding':75A 'blacklist':287C 'business':37A 'cannot':292C 'charging':51A,60A 'cloud':64A,72A,80A,175B 'command':215B,247C 'commerce':41A 'communications':45A,54A,63A,71A,79A,85A,90A,95A,100A,105A 'core':66A,74A,82A 'craft':205B 'cve':13A,16A 'debian':22A,24A,26A 'default':289C 'deseri':191B 'elastic':50A,59A 'engine':52A,61A 'execut':246C 'exploit':170B 'fedora':29A,31A,33A 'fedoraproject':28A,30A,32A 'follow':263C 'foundat':176B 'framework':141A,144A,147A,150A,153A,156A,159A,271C 'function':77A 'general':296C 'guided':42A 'host':250C 'inject':199B 'input':195B,256C 'inventory':87A,92A,97A,102A,107A 'java':171B,180B 'librari':5A,181B,223C 'limit':275C 'linux':23A,25A,27A 'local':214B 'longer':285C 'management':49A,58A,88A,93A,98A,103A,108A 'manipul':253C 'may':237C 'minim':278C 'monitoring':39A 'native':65A,73A,81A 'netapp':34A 'object':8A,184B,200B,226C 'of':113A,119A,125A,131A,137A 'oracle':36A,40A,44A,53A,62A,70A,78A,84A,89A,94A,99A,104A,109A,115A,121A,127A,133A,139A,142A,145A,148A,151A,154A,157A,160A,164A,167A 'packag':172B 'point':112A,118A,124A,130A,136A 'policy':83A 'portal':166A,169A 'process':255C 'purpos':297C 'recommend':265C 'remot':240C 'replac':197B 'requir':279C 'retail':110A,116A,122A,128A,134A 'revenue':48A,57A 'right':244C 'run':212B 'search':43A 'secur':270C,294C 'send':204B 'serial':7A,183B,225C 'server':218B 'service':114A,120A,126A,132A,138A 'setup':267C 'simpl':4A,222C 'sinc':290C 'snapmanager':35A 'stream':257C 'suffici':243C 'suite':69A 'suppli':194B 'support':76A 'test':68A 'testing':162A 'trick':189B 'type':280C 'unified':86A,91A,96A,101A,106A 'use':283C 'user':259C 'utilities':140A,143A,146A,149A,152A,155A,158A,161A 'version':234C 'vmware':174B 'vmware-cloud-found':173B 'vulner':236C 'webcenter':165A,168A 'whitelist':274C 'xml':10A,186B,206B,228C 'xstore':111A,117A,123A,129A,135A 'xstream':1A,19A,20A,21A,177B,178B,219C,268C,281C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-23T18:15:12+00:00","kev":{"dateAdded":"2023-03-10","dueDate":"2023-03-31","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-39144","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-39144","severity":null,"published_at":"2023-03-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-39144","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39144","severity":null,"published_at":"2021-08-23T18:15:12+00:00","modified_at":"2026-06-17T04:03:09+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}