CVE-2021-21349: apache activemq Deserialization of Untrusted Data
Vulnerability summary
CVE-2021-21349 is a high (CVSS 8.6) Deserialization of Untrusted Data vulnerability in apache activemq. EPSS estimates a 46.83% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 22-03-2021PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA6.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:NDiffers
EPSS trend
Probability
46.83%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 46.83% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (x-stream.github.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Oracle11 products
- banking_enterprise_default_management2.10.0 | 2.12.0
- banking_platform2.4.0 | 2.7.1 | 2.9.0 | 2.12.0
- banking_virtual_account_management14.2.0 | 14.3.0 | 14.5.0
- business_activity_monitoring11.1.1.9.0 | 12.2.1.3.0 | 12.2.1.4.0
- communications_billing_and_revenue_management_elastic_charging_engine12.0.0.3.0
Chainguard2 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
- libxstream-java< 1.4.15-2
- debian_linuxEOL9.0 | 10.0 | 11.0
Com.thoughtworks.xstream1 product
- xstream< 1.4.16
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Netapp1 product
Ubuntu1 product
- libxstream-java< 1.4.7-1ubuntu0.1+esm2 | < 1.4.8-1ubuntu0.1+esm3 | < 1.4.11.1-1~18.04.2 | < 1.4.11.1-1ubuntu0.2
X-stream1 product
- xstream< 1.4.16
Xstream1 product
- xstream< 1.4.16
10 vendors · 23 products
References
28 links- github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjvX Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
Show all 28 references
- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
- www.debian.org/security/2021/dsa-5004Vendor AdvisoryX Refsource DEBIANAdvisoryWEBMailing ListThird Party Advisory
- github.com/x-stream/xstreamPACKAGE