CVE-2021-21350: apache activemq
Vulnerability summary
CVE-2021-21350 is a critical (CVSS 9.8) vulnerability in apache activemq. EPSS estimates a 15.23% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 22-03-2021PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
15.23%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 15.23% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (x-stream.github.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Oracle10 products
- banking_enterprise_default_management2.10.0 | 2.12.0
- banking_platform2.4.0 | 2.7.1 | 2.9.0 | 2.12.0
- banking_virtual_account_management14.2.0 | 14.3.0 | 14.5.0
- business_activity_monitoring11.1.1.9.0 | 12.2.1.3.0 | 12.2.1.4.0
- communications_billing_and_revenue_management_elastic_charging_engine12.0.0.3.0
Chainguard2 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
- libxstream-java< 1.4.15-2
- debian_linuxEOL9.0 | 10.0 | 11.0
Com.thoughtworks.xstream1 product
- xstream< 1.4.16
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Netapp1 product
Ubuntu1 product
- libxstream-java< 1.4.7-1ubuntu0.1+esm2 | < 1.4.8-1ubuntu0.1+esm3 | < 1.4.11.1-1~18.04.2 | < 1.4.11.1-1ubuntu0.2
X-stream1 product
- xstream< 1.4.16
Xstream1 product
- xstream< 1.4.16
10 vendors · 22 products
References
28 links- github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrqX Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
Show all 28 references
- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAAdvisoryMailing ListThird Party Advisory
- www.debian.org/security/2021/dsa-5004Vendor AdvisoryX Refsource DEBIANAdvisoryWEBMailing ListThird Party Advisory
- github.com/x-stream/xstreamPACKAGE