XStream is vulnerable to an Arbitrary Code Execution attack
Priority CRITICAL 88CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 fixed, 12 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-434.
Summary
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.82136 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xstream (x-stream): 1.4.16com.thoughtworks.xstream:xstream (Maven): 1.4.16Red Hat: 6 advisoriesRed Hat: 6 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.16 | 1.4.16 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.16 | 1.4.16 | Patch available | GHSA-hrcp-8f3q-4w2c |
- xstream VendorXStream Affected before 1.4.16 Fixed in 1.4.16 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.16 Fixed in 1.4.16 Patch available GHSA-hrcp-8f3q-4w2c
CPE configurations NVD · 39
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.15.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:* | 5.16.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:* | 5.16.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:* | before 5.5 | Vulnerable | Apache |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | before 1.4.16 | Vulnerable | XStream |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.15.14 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:* Versions 5.16.0 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:* Versions 5.16.1 Vulnerable ·Apache
- cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:* Versions before 5.5 Vulnerable ·Apache
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.16 Vulnerable ·XStream
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Show 29 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* | 2.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | 2.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:* | 12.0.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* | 12.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:* | 7.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* | 7.3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* | 7.3.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | up to 8.0.27 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:* Versions 7.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions up to 8.0.27 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.16
- Fix · GHSA-hrcp-8f3q-4w2c com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.16 Advisory →
Red Hat 6 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4918 Released 2021-12-02 · Red Hat rating ModerateRed Hat Integration Camel-K 1.6 release and security update
- Red Hat Integration
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
Show 3 more Red Hat advisories
- RHSA-2021:2476 Released 2021-06-17 · Red Hat rating ModerateRed Hat Decision Manager 7.11.0 security update
- RHDM 7.11.0
- RHSA-2021:2475 Released 2021-06-17 · Red Hat rating ModerateRed Hat Process Automation Manager 7.11.0 security update
- RHPAM 7.11.0
- RHSA-2021:2139 Released 2021-05-26 · Red Hat rating CriticalRed Hat Data Grid 8.2.0 security update
- Red Hat Data Grid 8.2.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| RHDM 7.11.0 | Fixed | RHSA-2021:2476 |
| RHPAM 7.11.0 | Fixed | RHSA-2021:2475 |
| Red Hat Data Grid 8.2.0 | Fixed | RHSA-2021:2139 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Integration | Fixed | RHSA-2021:4918 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21351
- 2026-10-03 Alias added: GHSA-hrcp-8f3q-4w2c
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: HIGH → CRITICAL
References
Advisory 14
- https://x-stream.github.io/security.html#workaround
- http://x-stream.github.io/changes.html#1.4.16
- https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c
- [debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update
- [jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)
- [activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs
- https://security.netapp.com/advisory/ntap-20210430-0002/
- https://www.oracle.com//security-alerts/cpujul2021.html
- FEDORA-2021-fbad11014a
- FEDORA-2021-d894ca87dc
- https://www.oracle.com/security-alerts/cpuoct2021.html
- FEDORA-2021-5e376c0ed9
- DSA-5004
- https://nvd.nist.gov/vuln/detail/CVE-2021-21351
Other 7
- https://github.com/x-stream/xstream
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://security.netapp.com/advisory/ntap-20210430-0002
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
- TI-2019-07494 Code injection in xstream CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-21351 · CVE Program
- CVE-2021-21351 · NVD
- FIRST EPSS
- GHSA-hrcp-8f3q-4w2c · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21351 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences