CVE-2021-29505
mediumpriority · attend · 72EPSS 0.772 · 100 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-26
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- MyBlackManba/CVE-2021-29505对CVE-2021-29505进行复现，并分析学了下Xstream反序列化过程PoC · poc_in_github
- cuijiung/xstream-CVE-2021-29505cuijiung/xstream-CVE-2021-29505PoC · poc_in_github
affected products (76)
Products and version ranges known to be affected.
- NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-0607Red Hat FUSE: Mehrere SchwachstellenDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.
- WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
- WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
- GHSA-7chv-rrw6-w6fcXStream is vulnerable to a Remote Command Execution attack2021-05-18ghsa · osvUS
### Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. ### Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17. ### Workarounds See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs. ### References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.github.io/CVE-2021-29505.html). ### Credits V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. ### For more information If you have any questions or comments about this advisory: * Open an issue in [XStream](https://github.com/x-stream/xstream/issues) * Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (69)
External citations — patches, advisories, analysis.
- https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fcnnvd
- https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fccnnvd
- https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3Ecnnvd
- https://lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/cnnvd
- https://packetstormsecurity.com/files/163476/Red-Hat-Security-Advisory-2021-2683-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan