CVE catalog

CVE-2021-39152

libxstream-java: CVE-2021-39152

[CVE catalog]

Severity
High · CVSS 8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
11.38% · Oct 25, 2026

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxstream-javasid1.4.21-2fixed
Debianlibxstream-javaforky1.4.21-2fixed
Debianlibxstream-javatrixie1.4.21-1fixed
Debianlibxstream-javabookworm1.4.20-1+deb12u1fixed
CpexstreamNot reported1.4.18fixed
CpefedoraNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
CpesnapmanagerNot reportedNot reportedunknown
Cpebusiness_activity_monitoringNot reportedNot reportedunknown
Cpecommerce_guided_searchNot reportedNot reportedunknown
Cpecommunications_billing_and_revenue_management_elastic_charging_engineNot reportedNot reportedunknown
Cpecommunications_cloud_native_core_automated_test_suiteNot reportedNot reportedunknown
Cpecommunications_cloud_native_core_binding_support_functionNot reportedNot reportedunknown
Cpecommunications_cloud_native_core_policyNot reportedNot reportedunknown
Cpecommunications_unified_inventory_managementNot reportedNot reportedunknown
Ubuntulibxstream-java18.041.4.10-1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.1vulnerable
Ubuntulibxstream-java18.041.4.11.1-1~18.04.2vulnerable
Ubuntulibxstream-java18.041.4.11.1-1+deb10u4build0.18.04.1fixed
Ubuntulibxstream-java20.041.4.11.1-1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.1vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.2vulnerable
Ubuntulibxstream-java20.041.4.11.1-1ubuntu0.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxstream-javasourcesid1.4.18-1not yet assignedNot reported[998054]
Debianlibxstream-javasourceforky1.4.18-1not yet assignedNot reported[998054]
Debianlibxstream-javasourcetrixie1.4.18-1not yet assignedNot reported[998054]
Debianlibxstream-javasourcebookworm1.4.18-1not yet assignedNot reported[998054]
CpexstreamcpeNot reported1.4.18Not reportedNVD-CVE-2021-39152Not reported
Ubuntulibxstream-javadeb18.041.4.11.1-1+deb10u4build0.18.04.1Not reportedUBUNTU-CVE-2021-39152Not reported
Ubuntulibxstream-javadeb20.041.4.11.1-1ubuntu0.3Not reportedUBUNTU-CVE-2021-39152Not reported

[Debian bug #998054]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.18-1

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

    • 1.4.20-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.4.18-1

      dsa · libxstream-java · debian · bookworm; dsa · libxstream-java · debian · 12

[Debian 13 (Trixie)]

  • [libxstream-java]Fixed
    Details (2)

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.18-1

      dsa · libxstream-java · debian · 13

    • 1.4.21-1 · all · trixie

      Fixed · Fixed: 1.4.18-1

      dsa · libxstream-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]