CVE-2021-39144

8.5 highKEVEPSS 98%

High (8.5) in XStream XStream. In CISA KEV since 2023-03-10. EPSS 98% chance of exploitation in the next 30 days. Fixed in com.thoughtworks.xstream:xstream 1.4.18.

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

CVSS 3.1

8.5 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 98% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2023-03-10, due 2023-03-31
CWEs: CWE-306, CWE-502, CWE-94
Published: 2021-08-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
netapp:snapmanager
oracle:business_activity_monitoring
oracle:commerce_guided_search
oracle:communications_billing_and_revenue_management_elastic_charging_engine
oracle:communications_cloud_native_core_automated_test_suite
oracle:communications_cloud_native_core_binding_support_function
oracle:communications_cloud_native_core_policy
oracle:communications_unified_inventory_management
oracle:retail_xstore_point_of_service
oracle:utilities_framework
oracle:utilities_testing_accelerator
oracle:webcenter_portal
xstream:xstream

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-j9h8-phrw-h4fh	Maven	com.thoughtworks.xstream:xstream	<1.4.18	1.4.18

References

Check your stack JSON