High 8.8Published May 28, 2021

CVE-2021-29505XStream is software for serializing Java objects to XML and back again.

Updated under an hour ago (Oct 27, 2026, 8:30 PM ET)

Does this affect you?

It affects xstream and 16 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for xstream

Exploited in the last 30 days

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

CVSS: 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94, CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

xstream xstream xstream:xstream	before 1.4.17	NVD
debian debian_linux debian:debian_linux	9.0; 10.0; 11.0	NVD
fedoraproject fedora fedoraproject:fedora	33; 34; 35	NVD
netapp snapmanager netapp:snapmanager	all versions; all versions	NVD
oracle banking_cash_management oracle:banking_cash_management	14.2; 14.3; 14.5	NVD
oracle banking_corporate_lending_process_management oracle:banking_corporate_lending_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_credit_facilities_process_management oracle:banking_credit_facilities_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_supply_chain_finance oracle:banking_supply_chain_finance	14.2.0	NVD
oracle banking_trade_finance_process_management oracle:banking_trade_finance_process_management	14.5.0	NVD
oracle business_activity_monitoring oracle:business_activity_monitoring	11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0	NVD
1–10 of 17

References

References

https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f	patch, third-party-advisory
https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc	third-party-advisory
https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html	mailing-list, third-party-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
https://security.netapp.com/advisory/ntap-20210708-0007
https://www.debian.org/security/2021/dsa-5004	third-party-advisory
1–10 of 20

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.