7.5

CVE-2021-43859: Denial of Service by injecting highly recursive collections or maps in XStream

Modified
AliasesSUSE-SU-2022:0817-1UBUNTU-CVE-2021-43859DEBIAN-CVE-2021-43859
Published 01-02-2022Last modified 03-11-2025

Vulnerability summary

CVE-2021-43859 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 7.93% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
7.93%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 2
DLA-4001-1RHSA-2022:1420

Timeline

  1. 01-02-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

7.93%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.93% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Xstream

    Maturity: poc

  • referenceUnverified

    Exploit Reference (x-stream.github.io)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle7 products
Suse4 products
  • xstream&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.4.19-3.18.2
  • xstream&distro=SUSE Linux Enterprise Real Time 15 SP2< 1.4.19-3.18.2
  • xstream&distro=SUSE Manager Server Module 4.1< 1.4.19-3.18.2
  • xstream&distro=SUSE Manager Server Module 4.2< 1.4.19-3.18.2
Chainguard2 products
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
  • libxstream-java< 1.4.11.1-1+deb9u5 | < 1.4.19-1
  • debian_linuxEOL9.0
Opensuse2 products
  • xstream&distro=openSUSE Leap 15.3< 1.4.19-3.18.2
  • xstream&distro=openSUSE Tumbleweed< 1.4.19-1.1
Com.thoughtworks.xstream1 product
  • xstream< 1.4.19
Fedoraproject1 product
Jenkins1 product
  • jenkins< 2.319.3 | ≥ 2.321, < 2.334
Ubuntu1 product
  • libxstream-javaAll versions (No fix recorded)
X-stream1 product
Xstream1 product

11 vendors · 23 products

References

23 links
Show all 23 references