CVE catalog

CVE-2021-21341

libxstream-java: CVE-2021-21341

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
77.80% · Oct 25, 2026

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxstream-javasid1.4.21-2fixed
Debianlibxstream-javaforky1.4.21-2fixed
Debianlibxstream-javatrixie1.4.21-1fixed
Debianlibxstream-javabookworm1.4.20-1+deb12u1fixed
Cpeoncommand_insightNot reportedNot reportedunknown
CpeactivemqNot reportedNot reportedunknown
CpejmeterNot reported5.5fixed
CpexstreamNot reported1.4.16fixed
Cpedebian_linuxNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpebanking_enterprise_default_managementNot reportedNot reportedunknown
Cpebanking_platformNot reportedNot reportedunknown
Cpebusiness_activity_monitoringNot reportedNot reportedunknown
Ubuntulibxstream-javapro1.4.8-1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm2vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm3fixed
Ubuntulibxstream-java18.041.4.10-1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.2fixed
Ubuntulibxstream-java20.041.4.11.1-1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.2fixed
Susexstreamlinux enterprise module for development tools 15 sp21.4.16-3.8.1fixed
Susexstreamlinux enterprise module for development tools 15 sp31.4.16-3.8.1fixed
Susexstreammanager server module 4.11.4.16-3.8.1fixed
Susexstreammanager server module 4.21.4.16-3.8.1fixed
Opensusexstreamleap 15.31.4.16-3.8.1fixed
Opensusexstreamleap 15.21.4.16-lp152.2.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxstream-javasourcesid1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourceforky1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourcetrixie1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourcebookworm1.4.15-2not yet assignedNot reported[985843]
CpejmetercpeNot reported5.5Not reportedNVD-CVE-2021-21341Not reported
CpexstreamcpeNot reported1.4.16Not reportedNVD-CVE-2021-21341Not reported
Ubuntulibxstream-javadebpro1.4.8-1ubuntu0.1+esm3Not reportedUBUNTU-CVE-2021-21341Not reported
Ubuntulibxstream-javadeb18.041.4.11.1-1~18.04.2Not reportedUBUNTU-CVE-2021-21341Not reported
Ubuntulibxstream-javadeb20.041.4.11.1-1ubuntu0.2Not reportedUBUNTU-CVE-2021-21341Not reported
Susexstreamrpmlinux enterprise module for development tools 15 sp21.4.16-3.8.1Not reportedSUSE-SU-2021:1840-1Not reported
Susexstreamrpmlinux enterprise module for development tools 15 sp31.4.16-3.8.1Not reportedSUSE-SU-2021:1840-1Not reported
Susexstreamrpmmanager server module 4.11.4.16-3.8.1Not reportedSUSE-SU-2021:1840-1Not reported
Susexstreamrpmmanager server module 4.21.4.16-3.8.1Not reportedSUSE-SU-2021:1840-2Not reported
Opensusexstreamrpmleap 15.31.4.16-3.8.1Not reportedOPENSUSE-SU-2021:1840-1Not reported
Opensusexstreamrpmleap 15.21.4.16-lp152.2.6.1Not reportedOPENSUSE-SU-2021:0832-1Not reported

[Debian bug #985843]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

[Debian 13 (Trixie)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]