Skip to content
Fencer Vulns
high 8.5

CVE-2021-39144 kev in the critical feed json

XStream is vulnerable to a Remote Command Execution attack

published 2021-08-23 5 y ago modified 2026-07-08 4 mo ago also GHSA-j9h8-phrw-h4fh , EUVD-2021-1771

cvss
8.5
version 3.1, CNA
cisa kev
Exploited
added 2023-03-10
epss
98.1%
EPSS 98.1% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit, plus a Nuclei check

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • maven com.thoughtworks.xstream:xstream 1.4.18
  • xstream xstream 1.4.18
  • libxstream-java Debian 14, Debian 13, Debian 12 1.4.18-1

debian advisories DEBIAN-CVE-2021-39144

  • libxstream-java Ubuntu 18.04 LTS 1.4.11.1-1+deb10u4build0.18.04.1
  • libxstream-java Ubuntu 20.04 LTS 1.4.11.1-1ubuntu0.3

ubuntu advisories UBUNTU-CVE-2021-39144

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xstream RHEL 7 1.3.1-16.el7_9
  • xstream-javadoc RHEL 7 1.3.1-16.el7_9

red hat advisories RHSA-2021:3956

  • xstream SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2, Manager Server Module 4.2 +1 more 1.4.18-3.14.1

suse advisories SUSE-SU-2021:3476-1

  • xstream openSUSE Tumbleweed 1.4.18-1.1
  • xstream openSUSE Leap 15.2 1.4.18-lp152.2.12.1
  • xstream openSUSE Leap 15.3 1.4.18-3.14.1

opensuse advisories openSUSE-SU-2024:10592-1openSUSE-SU-2021:1401-1openSUSE-SU-2021:3476-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-39144 updated cvss 8.5

xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

  • Red Hat BPM Suite 6 xstream
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel Quarkus 1 xstream Red Hat JBoss A-MQ 6 xstream
    affected: no fix available
  • Red Hat JBoss BRMS 5 xstream Red Hat JBoss BRMS 6 xstream Red Hat JBoss Data Virtualization 6 xstream
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Fuse 6 xstream
    affected: no fix available
  • Red Hat JBoss Fuse Service Works 6 xstream Red Hat JBoss SOA Platform 5 xstream
    affected: no fix planned “Out of support scope”
  • Red Hat Data Grid 7.3.10
    fixed: vendor fix RHSA-2023:1303
  • Red Hat Data Grid 8.3.0
    fixed: vendor fix RHSA-2022:0520
  • Red Hat Enterprise Linux Client Optional (v. 7) xstream 1.3.1-16.el7_9, xstream-javadoc 1.3.1-16.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) xstream 1.3.1-16.el7_9, xstream-javadoc 1.3.1-16.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) xstream 1.3.1-16.el7_9, xstream-javadoc 1.3.1-16.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) xstream 1.3.1-16.el7_9, xstream-javadoc 1.3.1-16.el7_9
    fixed: vendor fix RHSA-2021:3956
show 6 more
  • Red Hat Integration
    fixed: vendor fix RHSA-2021:4918
  • Red Hat Integration Camel Quarkus 2
    fixed: vendor fix RHSA-2021:4767
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:3892
  • Red Hat RHDM 7.12.0
    fixed: vendor fix RHSA-2022:0297
  • Red Hat RHPAM 7.12.0
    fixed: vendor fix RHSA-2022:0296
  • Red Hat A-MQ Clients 2 xstream Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat Migration Toolkit for Applications 6 org.keycloak-keycloak-parent Red Hat Migration Toolkit for Runtimes org.keycloak-keycloak-parent Red Hat OpenShift Developer Tools and Services jenkins Red Hat AMQ Broker 7 xstream
    +11 more products
    Red Hat build of Apache Camel for Spring Boot 3 xstream Red Hat build of Apicurio Registry 2 xstream Red Hat build of Debezium 1 xstream Red Hat build of Quarkus xstream Red Hat Fuse 7 xstream Red Hat JBoss Enterprise Application Platform 6 xstream Red Hat JBoss Enterprise Application Platform 7 xstream Red Hat JBoss Enterprise Application Platform Expansion Pack xstream Red Hat OpenShift Application Runtimes xstream Red Hat OpenShift Container Platform 3.11 jenkins Red Hat OpenShift Container Platform 4 jenkins
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-03-31 (3 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
XStream, XStream
CISA name
XStream Remote Code Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1203 Exploitation for Client Execution primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

98.12% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
maven com.thoughtworks.xstream:xstream
<1.4.18
1.4.18

Affected products

  • x-stream xstream

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-502 Deserialization of Untrusted Data
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.