A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

Summary

CVE	CVE-2021-39150
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-08-23 19:15:12 UTC
Updated	2026-10-07 21:17:04 UTC
Description	XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

Risk And Classification

Primary CVSS: v3.1 8.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.034370000 probability, percentile 0.886290000 (date 2026-10-07)

Problem Types: CWE-502 | CWE-918 | CWE-502 CWE-502: Deserialization of Untrusted Data | CWE-918 CWE-918: Server-Side Request Forgery (SSRF)

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	8.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`
3.1	[email protected]	Secondary	8.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`
3.1	CNA	DECLARED	8.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`
2.0	[email protected]	Primary	6		`AV:N/AC:M/Au:S/C:P/I:P/A:P`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Debian	Debian Linux	11.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Fedoraproject	Fedora	34	All	All	All
Operating System	Fedoraproject	Fedora	35	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Application	Netapp	Snapmanager	-	All	All	All
Application	Oracle	Business Activity Monitoring	12.2.1.4.0	All	All	All
Application	Oracle	Commerce Guided Search	11.3.2	All	All	All
Application	Oracle	Communications Billing And Revenue Management Elastic Charging Engine	11.3	All	All	All
Application	Oracle	Communications Billing And Revenue Management Elastic Charging Engine	12.0	All	All	All
Application	Oracle	Communications Cloud Native Core Automated Test Suite	1.9.0	All	All	All
Application	Oracle	Communications Cloud Native Core Binding Support Function	1.10.0	All	All	All
Application	Oracle	Communications Cloud Native Core Policy	1.14.0	All	All	All
Application	Oracle	Communications Unified Inventory Management	7.3.4	All	All	All
Application	Oracle	Communications Unified Inventory Management	7.3.5	All	All	All
Application	Oracle	Communications Unified Inventory Management	7.4.0	All	All	All
Application	Oracle	Communications Unified Inventory Management	7.4.1	All	All	All
Application	Oracle	Communications Unified Inventory Management	7.4.2	All	All	All
Application	Oracle	Retail Xstore Point Of Service	16.0.6	All	All	All
Application	Oracle	Retail Xstore Point Of Service	17.0.4	All	All	All
Application	Oracle	Retail Xstore Point Of Service	18.0.3	All	All	All
Application	Oracle	Retail Xstore Point Of Service	19.0.2	All	All	All
Application	Oracle	Retail Xstore Point Of Service	20.0.1	All	All	All
Application	Oracle	Utilities Framework	4.2.0.2.0	All	All	All
Application	Oracle	Utilities Framework	4.2.0.3.0	All	All	All
Application	Oracle	Utilities Framework	4.3.0.1.0	All	All	All
Application	Oracle	Utilities Framework	4.3.0.6.0	All	All	All
Application	Oracle	Utilities Framework	4.4.0.0.0	All	All	All
Application	Oracle	Utilities Framework	4.4.0.2.0	All	All	All
Application	Oracle	Utilities Framework	4.4.0.3.0	All	All	All
Application	Oracle	Utilities Testing Accelerator	6.0.0.1.1	All	All	All
Application	Oracle	Webcenter Portal	12.2.1.3.0	All	All	All
Application	Oracle	Webcenter Portal	12.2.1.4.0	All	All	All
Application	Xstream	Xstream	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	X-stream	Xstream	affected < 1.4.18	Not specified

References

Reference	Source	Link	Tags
Oracle Critical Patch Update Advisory - April 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
[SECURITY] [DLA 2769-1] libxstream-java security update	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org	Mailing List, Third Party Advisory
[SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
Oracle Critical Patch Update Advisory - January 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
Oracle Critical Patch Update Advisory - July 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Third Party Advisory
August 2021 XStream Vulnerabilities in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
[SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
[SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List
XStream - CVE-2021-39150	af854a3a-2127-422b-91ae-364da2661108	x-stream.github.io	Exploit, Third Party Advisory
Debian -- Security Information -- DSA-5004-1 libxstream-java	af854a3a-2127-422b-91ae-364da2661108	www.debian.org	Third Party Advisory
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host · Advisory · x-stream/xstream · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Third Party Advisory
[SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

159437 Oracle Enterprise Linux Security Update for xstream (ELSA-2021-3956)
178813 Debian Security Update for libxstream-java (DLA 2769-1)
178889 Debian Security Update for libxstream-java (DSA 5004-1)
178890 Debian Security Update for libxstream-java (DSA 5004-1)
183478 Debian Security Update for libxstream-java (CVE-2021-39150)
199237 Ubuntu Security Notification for XStream Vulnerabilities (USN-5946-1)
239729 Red Hat Update for xstream (RHSA-2021:3956)
281980 Fedora Security Update for xstream (FEDORA-2021-d894ca87dc)
281981 Fedora Security Update for xstream (FEDORA-2021-fbad11014a)
353077 Amazon Linux Security Advisory for xstream : ALAS2-2021-1729
375827 XStream Arbitrary Code Execution And Multiple vulnerabilities
376998 Alibaba Cloud Linux Security Update for xstream (ALINUX2-SA-2021:0065)
751258 OpenSUSE Security Update for xstream (openSUSE-SU-2021:3476-1)
751298 OpenSUSE Security Update for xstream (openSUSE-SU-2021:1401-1)
980146 Java (maven) Security Update for com.thoughtworks.xstream:xstream (GHSA-cxfm-5m4g-x7xp)