CVE-2021-43859

Aliases:GHSA-rmr5-cpv2-vgjfBIT-jenkins-2021-43859
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 01 Feb 2022, 12:08
Last modified:03 Nov 2025, 21:45

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.86% LOW
2% probability -0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

01 Feb 2022, 12:08
Published
Vulnerability first disclosed
03 Nov 2025, 21:45
Last Modified
Vulnerability information updated

Description

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 1.86%• Percentile: 83%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • debian•debian_linux

    9.0

  • fedoraproject•fedora

    34 | 35

  • Unknown•Jenkins

    < 2.319.3 | ≥ 2.321, < 2.334

  • com.thoughtworks.xstream•xstream

    < 1.4.19

  • oracle•commerce_guided_search

    11.3.2

  • oracle•communications_brm_-_elastic_charging_engine

    < 12.0.0.4.6 | 12.0.0.5.0

  • oracle•communications_cloud_native_core_automated_test_suite

    1.9.0

  • oracle•communications_diameter_intelligence_hub

    ≥ 8.0.0, ≤ 8.1.0 | ≥ 8.2.0, ≤ 8.2.6

  • oracle•communications_policy_management

    12.6.0.0.0

  • oracle•flexcube_private_banking

    12.1.0

  • oracle•retail_xstore_point_of_service

    16.0.6 | 17.0.4 | 18.0.3 | 19.0.2 | 20.0.1

  • x-stream•xstream

    < 1.4.19

  • Unknown•XStream

    < 1.4.19

References (16)