CVE-2021-39144
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has…
Browse: All 2021 CVEs · All vendors
- CVSS score
- 8.5 High
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H- CISA KEV
- Yes — actively exploited (added 2023-03-10, remediation due 2023-03-31)
- Weakness (CWE)
- CWE-94, CWE-502, CWE-306
- Published
- 2021-08-23
- Last modified
- 2026-06-17
- NVD status
- Analyzed
Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected products
- xstream xstream
- debian debian linux
- fedoraproject fedora
- netapp snapmanager
- oracle business activity monitoring
- oracle commerce guided search
- oracle communications billing and revenue management elastic charging engine
- oracle communications cloud native core automated test suite
- oracle communications cloud native core binding support function
- oracle communications cloud native core policy
- oracle communications unified inventory management
- oracle retail xstore point of service
Affected ranges per NVD CPE data; confirm exact versions in the vendor advisory.
Required action (CISA)
Apply updates per vendor instructions. Federal remediation deadline: 2023-03-31.
How to prioritize this
This vulnerability is on the CISA KEV list, meaning it is being actively exploited — treat it as urgent regardless of the raw CVSS number. Use the live CVE lookup for the latest NVD data, and the CVSS 3.1 calculator to model your own environmental score. For the actively exploited vulnerabilities that matter this week, read The Exploit HQ daily security brief.
References
- http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
- https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://security.netapp.com/advisory/ntap-20210923-0003/
- https://www.debian.org/security/2021/dsa-5004
FAQ
Is CVE-2021-39144 actively exploited?
Yes. CISA added CVE-2021-39144 to its Known Exploited Vulnerabilities (KEV) catalog on 2023-03-10, with a federal remediation deadline of 2023-03-31. A KEV listing means real-world exploitation is confirmed, so patching this should be prioritized above many higher-CVSS bugs that aren't being exploited.
What is the CVSS score of CVE-2021-39144?
CVE-2021-39144 has a CVSS base score of 8.5 (High). Its vector string is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Related vulnerabilities
- CVE-2026-0322 — Palo Alto Networks PAN-OS
- CVE-2026-65660 — Microsoft SharePoint
- CVE-2026-60004 — Gitea Gitea
- CVE-2026-72530 — TrueConf Server
- CVE-2025-62593 — Ray-Project Ray
- CVE-2026-9198 — IBM Langflow
Data source: NVD & CISA KEV. Shown as-is; nothing added. Last generated from NVD data — re-check the live tool for updates.
kev brief
Patch what's actually being exploited.
Subscribe and get the KEV Patch Priority Playbook, free, in your inbox now.
Free. No spam. Unsubscribe anytime. Delivered by Beehiiv.