CVE catalog

CVE-2021-21346

libxstream-java: CVE-2021-21346

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
76.37% · Oct 25, 2026

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxstream-javasid1.4.21-2fixed
Debianlibxstream-javaforky1.4.21-2fixed
Debianlibxstream-javatrixie1.4.21-1fixed
Debianlibxstream-javabookworm1.4.20-1+deb12u1fixed
Cpeoncommand_insightNot reportedNot reportedunknown
CpeactivemqNot reportedNot reportedunknown
CpejmeterNot reported5.5fixed
CpexstreamNot reported1.4.16fixed
Cpedebian_linuxNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpebanking_enterprise_default_managementNot reportedNot reportedunknown
Cpebanking_platformNot reportedNot reportedunknown
Cpebanking_virtual_account_managementNot reportedNot reportedunknown
Ubuntulibxstream-javapro1.4.8-1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm1vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm2vulnerable
Ubuntulibxstream-javapro1.4.8-1ubuntu0.1+esm3fixed
Ubuntulibxstream-java18.041.4.10-1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.2fixed
Ubuntulibxstream-java20.041.4.11.1-1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.2fixed
Ubuntulibxstream-java22.041.4.15-4vulnerable
Ubuntulibxstream-java22.041.4.18-2vulnerable
Ubuntulibxstream-java22.041.4.18-2ubuntu0.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxstream-javasourcesid1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourceforky1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourcetrixie1.4.15-2not yet assignedNot reported[985843]
Debianlibxstream-javasourcebookworm1.4.15-2not yet assignedNot reported[985843]
CpejmetercpeNot reported5.5Not reportedNVD-CVE-2021-21346Not reported
CpexstreamcpeNot reported1.4.16Not reportedNVD-CVE-2021-21346Not reported
Ubuntulibxstream-javadebpro1.4.8-1ubuntu0.1+esm3Not reportedUBUNTU-CVE-2021-21346Not reported
Ubuntulibxstream-javadeb18.041.4.11.1-1~18.04.2Not reportedUBUNTU-CVE-2021-21346Not reported
Ubuntulibxstream-javadeb20.041.4.11.1-1ubuntu0.2Not reportedUBUNTU-CVE-2021-21346Not reported

[Debian bug #985843]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

[Debian 13 (Trixie)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.15-2

      dsa · libxstream-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]