Disclosure summary
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Source-reported weakness categories
CWE-434, CWE-502
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-39139
Open original source · Updated Oct 07, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| xstream | xstream | * {"versionEndExcluding":"1.4.18"} |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| fedoraproject | fedora | 33 |
| fedoraproject | fedora | 34 |
| fedoraproject | fedora | 35 |
| netapp | snapmanager | - |
| netapp | snapmanager | - |
| oracle | business_activity_monitoring | 12.2.1.4.0 |
| oracle | commerce_guided_search | 11.3.2 |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 11.3 |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 12.0 |
| oracle | communications_cloud_native_core_automated_test_suite | 1.9.0 |
| oracle | communications_cloud_native_core_binding_support_function | 1.10.0 |
| oracle | communications_cloud_native_core_policy | 1.14.0 |
| oracle | communications_unified_inventory_management | 7.3.4 |
| oracle | communications_unified_inventory_management | 7.3.5 |
| oracle | communications_unified_inventory_management | 7.4.0 |
| oracle | communications_unified_inventory_management | 7.4.1 |
| oracle | communications_unified_inventory_management | 7.4.2 |
| oracle | retail_xstore_point_of_service | 16.0.6 |
| oracle | retail_xstore_point_of_service | 17.0.4 |
| oracle | retail_xstore_point_of_service | 18.0.3 |
| oracle | retail_xstore_point_of_service | 19.0.2 |
| oracle | retail_xstore_point_of_service | 20.0.1 |
| oracle | utilities_framework | 4.2.0.2.0 |
| oracle | utilities_framework | 4.2.0.3.0 |
| oracle | utilities_framework | 4.3.0.1.0 |
| oracle | utilities_framework | 4.3.0.6.0 |
| oracle | utilities_framework | 4.4.0.0.0 |
| oracle | utilities_framework | 4.4.0.2.0 |
| oracle | utilities_framework | 4.4.0.3.0 |
| oracle | utilities_testing_accelerator | 6.0.0.1.1 |
| oracle | webcenter_portal | 12.2.1.3.0 |
| oracle | webcenter_portal | 12.2.1.4.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Third Party Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- lists.fedoraproject.org — Mailing List
- lists.fedoraproject.org — Mailing List
- lists.fedoraproject.org — Mailing List
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- x-stream.github.io — Vendor Advisory
- github.com — Third Party Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- lists.fedoraproject.org — Mailing List
- lists.fedoraproject.org — Mailing List
- lists.fedoraproject.org — Mailing List
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- x-stream.github.io — Vendor Advisory
PUBLISHED 2021-08-23T14:15:10-04:00
MODIFIED 2026-10-07T17:17:03-04:00
INGESTED 2026-10-08T12:30:35-04:00