---
id: "CVE-2021-39144"
kind: "vulnerability"
aliases: ["CVE-2021-39144"]
title: "XStream is a simple library to serialize objects to XML and back again"
severity: "critical"
cvss: 8.5
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "XStream XStream", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "xstream", "fixed": ["1.4.18"], "affected": "< 1.4.18", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 33", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 34", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 35", "ecosystem": "vendor"}, {"name": "netapp snapmanager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "oracle business activity monitoring", "fixed": [], "affected": "= 12.2.1.4.0", "ecosystem": "vendor"}, {"name": "oracle commerce guided search", "fixed": [], "affected": "= 11.3.2", "ecosystem": "vendor"}, {"name": "oracle communications billing and revenue management elastic charging engine", "fixed": [], "affected": "= 11.3", "ecosystem": "vendor"}, {"name": "oracle communications billing and revenue management elastic charging engine", "fixed": [], "affected": "= 12.0", "ecosystem": "vendor"}, {"name": "oracle communications cloud native core automated test suite", "fixed": [], "affected": "= 1.9.0", "ecosystem": "vendor"}, {"name": "oracle communications cloud native core binding support function", "fixed": [], "affected": "= 1.10.0", "ecosystem": "vendor"}, {"name": "oracle communications cloud native core policy", "fixed": [], "affected": "= 1.14.0", "ecosystem": "vendor"}, {"name": "oracle communications unified inventory management", "fixed": [], "affected": "= 7.3.4", "ecosystem": "vendor"}, {"name": "oracle communications unified inventory management", "fixed": [], "affected": "= 7.3.5", "ecosystem": "vendor"}, {"name": "oracle communications unified inventory management", "fixed": [], "affected": "= 7.4.0", "ecosystem": "vendor"}, {"name": "oracle communications unified inventory management", "fixed": [], "affected": "= 7.4.1", "ecosystem": "vendor"}, {"name": "oracle communications unified inventory management", "fixed": [], "affected": "= 7.4.2", "ecosystem": "vendor"}, {"name": "oracle retail xstore point of service", "fixed": [], "affected": "= 16.0.6", "ecosystem": "vendor"}, {"name": "oracle retail xstore point of service", "fixed": [], "affected": "= 17.0.4", "ecosystem": "vendor"}, {"name": "oracle retail xstore point of service", "fixed": [], "affected": "= 18.0.3", "ecosystem": "vendor"}, {"name": "oracle retail xstore point of service", "fixed": [], "affected": "= 19.0.2", "ecosystem": "vendor"}, {"name": "oracle retail xstore point of service", "fixed": [], "affected": "= 20.0.1", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.2.0.2.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.2.0.3.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.3.0.1.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.3.0.6.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.4.0.0.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.4.0.2.0", "ecosystem": "vendor"}, {"name": "oracle utilities framework", "fixed": [], "affected": "= 4.4.0.3.0", "ecosystem": "vendor"}, {"name": "oracle utilities testing accelerator", "fixed": [], "affected": "= 6.0.0.1.1", "ecosystem": "vendor"}, {"name": "oracle webcenter portal", "fixed": [], "affected": "= 12.2.1.3.0", "ecosystem": "vendor"}, {"name": "oracle webcenter portal", "fixed": [], "affected": "= 12.2.1.4.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "package", "vmware-cloud-foundation", "xstream"]
not_affected_if: ["no-xstream-dependency"]
published_at: "2021-08-23T18:15:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-39144", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39144", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# XStream is a simple library to serialize objects to XML and back again

XStream, a Java library for serializing objects to XML, can be tricked into deserializing attacker-supplied input that replaces or injects objects. An attacker who sends crafted XML to an affected application can run a local command on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XStream XStream affected ? fixed ?
- vendor:xstream affected < 1.4.18 fixed 1.4.18
- vendor:debian linux affected = 9.0 fixed ?
- vendor:debian linux affected = 10.0 fixed ?
- vendor:debian linux affected = 11.0 fixed ?
- vendor:fedoraproject fedora affected = 33 fixed ?
- vendor:fedoraproject fedora affected = 34 fixed ?
- vendor:fedoraproject fedora affected = 35 fixed ?
- vendor:netapp snapmanager affected ? fixed ?
- vendor:oracle business activity monitoring affected = 12.2.1.4.0 fixed ?
- vendor:oracle commerce guided search affected = 11.3.2 fixed ?
- vendor:oracle communications billing and revenue management elastic charging engine affected = 11.3 fixed ?
- vendor:oracle communications billing and revenue management elastic charging engine affected = 12.0 fixed ?
- vendor:oracle communications cloud native core automated test suite affected = 1.9.0 fixed ?
- vendor:oracle communications cloud native core binding support function affected = 1.10.0 fixed ?
- vendor:oracle communications cloud native core policy affected = 1.14.0 fixed ?
- vendor:oracle communications unified inventory management affected = 7.3.4 fixed ?
- vendor:oracle communications unified inventory management affected = 7.3.5 fixed ?
- vendor:oracle communications unified inventory management affected = 7.4.0 fixed ?
- vendor:oracle communications unified inventory management affected = 7.4.1 fixed ?
- vendor:oracle communications unified inventory management affected = 7.4.2 fixed ?
- vendor:oracle retail xstore point of service affected = 16.0.6 fixed ?
- vendor:oracle retail xstore point of service affected = 17.0.4 fixed ?
- vendor:oracle retail xstore point of service affected = 18.0.3 fixed ?
- vendor:oracle retail xstore point of service affected = 19.0.2 fixed ?
- vendor:oracle retail xstore point of service affected = 20.0.1 fixed ?
- vendor:oracle utilities framework affected = 4.2.0.2.0 fixed ?
- vendor:oracle utilities framework affected = 4.2.0.3.0 fixed ?
- vendor:oracle utilities framework affected = 4.3.0.1.0 fixed ?
- vendor:oracle utilities framework affected = 4.3.0.6.0 fixed ?
- vendor:oracle utilities framework affected = 4.4.0.0.0 fixed ?
- vendor:oracle utilities framework affected = 4.4.0.2.0 fixed ?
- vendor:oracle utilities framework affected = 4.4.0.3.0 fixed ?
- vendor:oracle utilities testing accelerator affected = 6.0.0.1.1 fixed ?
- vendor:oracle webcenter portal affected = 12.2.1.3.0 fixed ?
- vendor:oracle webcenter portal affected = 12.2.1.4.0 fixed ?

## How to check

Find XStream in your dependencies (for example, search pom.xml, build.gradle or the packaged JAR for com.thoughtworks.xstream) and check the version against the advisory.

## Fix

Upgrade XStream to a version that fixes CVE-2021-39144 per the vendor instructions referenced by CISA; the exact fixed version is not in the sources.
If the affected products are VMware Cloud Foundation or similar, apply the vendor's update.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-39144
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-39144

## From the sources

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_