CVE catalog

CVE-2021-21342

libxstream-java affected and fixed versions

[CVE catalog]

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
49.99% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixielibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debiantrixielibxstream-java1.4.21-1Fixed[CVE-2021-21342]
Debiansidlibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debiansidlibxstream-java1.4.21-2Fixed[CVE-2021-21342]
Debianforkylibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debianforkylibxstream-java1.4.21-2Fixed[CVE-2021-21342]
Debianbookwormlibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debianbookwormlibxstream-java1.4.20-1+deb12u1Fixed[CVE-2021-21342]

Showing 8 fix observations. All 20 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormlibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debianbookwormlibxstream-java1.4.20-1+deb12u1Fixed[CVE-2021-21342]
Debianforkylibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debianforkylibxstream-java1.4.21-2Fixed[CVE-2021-21342]
Debiansidlibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debiansidlibxstream-java1.4.21-2Fixed[CVE-2021-21342]
Debiantrixielibxstream-java1.4.15-2FixedDistribution-reported fixed boundary[CVE-2021-21342]
Debiantrixielibxstream-java1.4.21-1Fixed[CVE-2021-21342]
Ubuntu18.04libxstream-java1.4.10-1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu18.04libxstream-java1.4.11.1-1~18.04UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu18.04libxstream-java1.4.11.1-1~18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu18.04libxstream-java1.4.11.1-1~18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu20.04libxstream-java1.4.11.1-1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu20.04libxstream-java1.4.11.1-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntu20.04libxstream-java1.4.11.1-1ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntuprolibxstream-java1.4.8-1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntuprolibxstream-java1.4.8-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntuprolibxstream-java1.4.8-1ubuntu0.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntuprolibxstream-java1.4.8-1ubuntu0.1+esm2UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Ubuntuprolibxstream-java1.4.8-1ubuntu0.1+esm3UnknownSource applicability is not established[UBUNTU-CVE-2021-21342]
Original provider fields
{
  "package_releases": [
    {
      "name": "libxstream-java",
      "status": "fixed",
      "release": "sid",
      "version": "1.4.21-2"
    },
    {
      "name": "libxstream-java",
      "status": "fixed",
      "release": "forky",
      "version": "1.4.21-2"
    },
    {
      "name": "libxstream-java",
      "status": "fixed",
      "release": "trixie",
      "version": "1.4.21-1"
    },
    {
      "name": "libxstream-java",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.4.20-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 985843,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.15-2"
    },
    {
      "bug": 985843,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.15-2"
    },
    {
      "bug": 985843,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.15-2"
    },
    {
      "bug": 985843,
      "name": "libxstream-java",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.15-2"
    }
  ],
  "distribution_packages": [
    {
      "name": "oncommand_insight",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "activemq",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "jmeter",
      "ranges": [
        {
          "fixed": "5.5",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "5.5",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "xstream",
      "ranges": [
        {
          "fixed": "1.4.16",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "1.4.16",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "debian_linux",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "fedora",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "banking_enterprise_default_management",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "banking_platform",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "banking_virtual_account_management",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21342",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2021-21342",
      "provider_updated_at": "2026-10-07T19:17:20.313"
    },
    {
      "name": "libxstream-java",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.8-1ubuntu0.1+esm3"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.4.8-1",
        "1.4.8-1ubuntu0.1",
        "1.4.8-1ubuntu0.1+esm1",
        "1.4.8-1ubuntu0.1+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-21342",
      "fixed_version": "1.4.8-1ubuntu0.1+esm3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-21342",
      "provider_updated_at": "2026-02-04T04:11:07.642155Z",
      "applicability_unknown": true
    },
    {
      "name": "libxstream-java",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1~18.04.2"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-21342",
      "fixed_version": "1.4.11.1-1~18.04.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-21342",
      "provider_updated_at": "2026-02-04T04:11:07.642155Z",
      "applicability_unknown": true
    },
    {
      "name": "libxstream-java",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-21342",
      "fixed_version": "1.4.11.1-1ubuntu0.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-21342",
      "provider_updated_at": "2026-02-04T04:11:07.642155Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #985843]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxstream-java]Unknown
    Details (2)

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

[Debian 13 (Trixie)]

  • [libxstream-java]Unknown
    Details (2)

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]