Critical
Security advisory
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-21346
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:55 UTC · Revision 1
Source evidence
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
osv:CVE-2021-21346
Complete source record
{
"id": "c0b66f3c0aebe09e2fc1a4dfecc7d8be3eed52e4e46ffc4fe6dbb9e503666ef3",
"url": "https://osv.dev/vulnerability/CVE-2021-21346",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-21346",
"summary": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"evidence": "osv:CVE-2021-21346",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-21346",
"aliases": [
"BIT-activemq-2021-21346",
"CVE-2021-21346",
"GHSA-4hrm-m67v-5cxr"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/activemq",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a0d4141a00ba5de4afaee160836898b41eb28065"
},
{
"introduced": "86dd78b1aa64cbf0af15669c0e4af62dfae0d158"
},
{
"last_affected": "e432a78c19e9c30b5afd84e591a428734ad55431"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.15.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.16.0"
},
{
"last_affected": "5.16.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.16.1"
},
{
"last_affected": "5.16.1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"5.16.0",
"5.16.1",
"activemq-5.16.1",
"activemq-5.16.0",
"activemq-5.15.13",
"activemq-5.15.12",
"activemq-5.15.11",
"activemq-5.15.10",
"activemq-5.15.9",
"activemq-5.15.8",
"activemq-5.15.7",
"activemq-5.15.6",
"activemq-5.15.5",
"activemq-5.15.4",
"activemq-5.15.3",
"activemq-5.15.2",
"activemq-5.15.1",
"activemq-5.15.0",
"activemq-5.14.0",
"activemq-5.13.0",
"activemq-5.12.0",
"activemq-5.11.0",
"activemq-5.10.0",
"activemq-5.9.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21346.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/apache/jmeter",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7153c74dd0e860d0ca3825cc5a23e976e0242b6e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.5"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v5.5-rc2",
"v5.5-rc1",
"v5.4.1-rc2",
"rel/v5.4.1",
"v5.4.1-rc1",
"v5.4-rc2",
"rel/v5.4",
"v5.4-rc1",
"v5.3-rc1",
"rel/v5.3",
"v5.2.1-rc5",
"rel/v5.2.1",
"v5.2.1-rc4",
"v5.2.1-rc1",
"rel/v5.2",
"v5.2-rc5",
"v5.2-rc4",
"5.2-rc4",
"v5.2-rc3",
"v5.2-rc2",
"v5.2-rc1",
"v5_2_RC1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21346.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/x-stream/xstream",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3dd9cc610199802e4f13bd49b02a9f99adaba145"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.4.16"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"XSTREAM_1_4_15",
"XSTREAM_1_4_14",
"XSTREAM_1_4_13",
"XSTREAM_1_4_12",
"XSTREAM_1_4_11_1",
"XSTREAM_1_4_11",
"XSTREAM_1_4_10",
"XSTREAM_1_4_9",
"XSTREAM_1_4_5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21346.json"
}
}
],
"modified": "2026-10-24T10:50:40.595916927Z",
"provider": "osv",
"references": [
"https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr",
"https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
"https://security.netapp.com/advisory/ntap-20210430-0002/",
"https://www.debian.org/security/2021/dsa-5004",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://x-stream.github.io/security.html#workaround",
"https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://x-stream.github.io/CVE-2021-21346.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
},
{
"introduced": "11.0"
},
{
"last_affected": "11.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "33"
},
{
"last_affected": "33"
},
{
"introduced": "34"
},
{
"last_affected": "34"
},
{
"introduced": "35"
},
{
"last_affected": "35"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_enterprise_default_management",
"extracted_events": [
{
"range": [
{
"introduced": "2.10.0"
},
{
"last_affected": "2.10.0"
},
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_platform",
"extracted_events": [
{
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
},
{
"introduced": "2.7.1"
},
{
"last_affected": "2.7.1"
},
{
"introduced": "2.9.0"
},
{
"last_affected": "2.9.0"
},
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_virtual_account_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2.0"
},
{
"last_affected": "14.2.0"
},
{
"introduced": "14.3.0"
},
{
"last_affected": "14.3.0"
},
{
"introduced": "14.5.0"
},
{
"last_affected": "14.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:bi_publisher",
"extracted_events": [
{
"range": [
{
"introduced": "5.5.0.0.0"
},
{
"last_affected": "5.5.0.0.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:business_activity_monitoring",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.1.9.0"
},
{
"last_affected": "11.1.1.9.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_billing_and_revenue_management_elastic_charging_engine",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0.3.0"
},
{
"last_affected": "12.0.0.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_policy_management",
"extracted_events": [
{
"range": [
{
"introduced": "12.5.0"
},
{
"last_affected": "12.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_unified_inventory_management",
"extracted_events": [
{
"range": [
{
"introduced": "7.3.2"
},
{
"last_affected": "7.3.2"
},
{
"introduced": "7.3.4"
},
{
"last_affected": "7.3.4"
},
{
"introduced": "7.3.5"
},
{
"last_affected": "7.3.5"
},
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
},
{
"introduced": "7.4.1"
},
{
"last_affected": "7.4.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_xstore_point_of_service",
"extracted_events": [
{
"range": [
{
"introduced": "16.0.6"
},
{
"last_affected": "16.0.6"
},
{
"introduced": "17.0.4"
},
{
"last_affected": "17.0.4"
},
{
"introduced": "18.0.3"
},
{
"last_affected": "18.0.3"
},
{
"introduced": "19.0.2"
},
{
"last_affected": "19.0.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:webcenter_portal",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.1.9.0"
},
{
"last_affected": "11.1.1.9.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-21346",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442459,
"published_at": "2021-03-23T00:15:12.897+00:00"
}