{"id":"CVE-2021-29505","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-29505","generatedAt":"2026-11-05T01:22:13.128Z","title":"A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream.","description":"XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","published":"2021-05-28T21:15:09.000Z","lastModified":"2026-10-07T21:17:03.000Z","status":"Modified","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-94","CWE-502"],"affected":["xstream/xstream","debian/debian linux","fedoraproject/fedora","netapp/snapmanager","oracle/banking cash management","oracle/banking corporate lending process management","oracle/banking credit facilities process management","oracle/banking supply chain finance","oracle/banking trade finance process management","oracle/business activity monitoring","oracle/communications brm - elastic charging engine","oracle/communications unified inventory management","oracle/enterprise manager ops center","oracle/retail customer insights","oracle/retail xstore point of service","oracle/webcenter portal","oracle/webcenter sites"],"epss":{"score":0.77232,"percentile":0.99554,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 77.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227","source":"security-advisories@github.com"},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc","tags":["Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E","source":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20210708-0007","source":"security-advisories@github.com"},{"url":"https://www.debian.org/security/2021/dsa-5004","tags":["Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Mailing List","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://x-stream.github.io/CVE-2021-29505.html","source":"security-advisories@github.com"},{"url":"https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E","tags":["Issue Tracking","Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210708-0007/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2021/dsa-5004","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-29505","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}