High 8.8Published May 28, 2021

CVE-2021-29505XStream is software for serializing Java objects to XML and back again.

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects xstream and 16 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for xstream

Exploited in the last 30 days

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

CVSS: 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94, CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

xstream xstream xstream:xstream	before 1.4.17	NVD
debian debian_linux debian:debian_linux	9.0; 10.0; 11.0	NVD
fedoraproject fedora fedoraproject:fedora	33; 34; 35	NVD
netapp snapmanager netapp:snapmanager	all versions; all versions	NVD
oracle banking_cash_management oracle:banking_cash_management	14.2; 14.3; 14.5	NVD
oracle banking_corporate_lending_process_management oracle:banking_corporate_lending_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_credit_facilities_process_management oracle:banking_credit_facilities_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_supply_chain_finance oracle:banking_supply_chain_finance	14.2.0	NVD
oracle banking_trade_finance_process_management oracle:banking_trade_finance_process_management	14.5.0	NVD
oracle business_activity_monitoring oracle:business_activity_monitoring	11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0	NVD
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine	11.3; 12.0	NVD
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management	7.3.4; 7.3.5; 7.4.0; 7.4.1; 7.4.2	NVD
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center	12.4.0.0	NVD
oracle retail_customer_insights oracle:retail_customer_insights	15.0.2; 16.0.2	NVD
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service	16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1	NVD
oracle webcenter_portal oracle:webcenter_portal	12.2.1.3.0; 12.2.1.4.0	NVD
oracle webcenter_sites oracle:webcenter_sites	12.2.1.3.0; 12.2.1.4.0	NVD

References

https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fpatch, third-party-advisory
https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fcthird-party-advisory
https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlmailing-list, third-party-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
https://security.netapp.com/advisory/ntap-20210708-0007
https://www.debian.org/security/2021/dsa-5004third-party-advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlpatch, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlpatch, third-party-advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlthird-party-advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlmailing-list, third-party-advisory
https://x-stream.github.io/CVE-2021-29505.html
https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3Eissue-tracking, mailing-list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/mailing-list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/mailing-list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/mailing-list
https://security.netapp.com/advisory/ntap-20210708-0007/third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.