CVE-2021-43859

7.5 highEPSS 7.9%

High (7.5). EPSS 7.9% chance of exploitation in the next 30 days. Fixed in com.thoughtworks.xstream:xstream 1.4.19.

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 7.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2022-02-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
jenkins:jenkins
oracle:commerce_guided_search
oracle:communications_brm_-_elastic_charging_engine
oracle:communications_cloud_native_core_automated_test_suite
oracle:communications_diameter_intelligence_hub
oracle:communications_policy_management
oracle:flexcube_private_banking
oracle:retail_xstore_point_of_service
xstream:xstream

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rmr5-cpv2-vgjf	Maven	com.thoughtworks.xstream:xstream	<1.4.19	1.4.19

References

Check your stack JSON