CVE-2021-21350

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

• CWE-434
• CWE-502

• https://x-stream.github.io/changes.html#1.4.16Release Notes, Third Party Advisory
• https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrqThird Party Advisory
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210430-0002/Third Party Advisory
• https://www.debian.org/security/2021/dsa-5004Mailing List, Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Vendor Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory
• https://x-stream.github.io/CVE-2021-21350.htmlExploit, Third Party Advisory
• https://x-stream.github.io/security.html#workaroundMitigation, Third Party Advisory
• https://x-stream.github.io/changes.html#1.4.16Release Notes, Third Party Advisory
• https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrqThird Party Advisory
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3EIssue Tracking, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210430-0002/Third Party Advisory
• https://www.debian.org/security/2021/dsa-5004Mailing List, Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Vendor Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory
• https://x-stream.github.io/CVE-2021-21350.htmlExploit, Third Party Advisory
• https://x-stream.github.io/security.html#workaroundMitigation, Third Party Advisory

Published

Mar 23, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21345XStream is a Java library to serialize objects to XML and ba…9.9
• CVE-2021-21346XStream is a Java library to serialize objects to XML and ba…9.8
• CVE-2021-21347XStream is a Java library to serialize objects to XML and ba…9.8
• CVE-2021-21348XStream is a Java library to serialize objects to XML and ba…7.5
• CVE-2021-21349XStream is a Java library to serialize objects to XML and ba…8.6
• CVE-2021-2135Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-21351XStream is a Java library to serialize objects to XML and ba…9.1
• CVE-2021-21352Anuko Time Tracker is an open source, web-based time trackin…9.1
• CVE-2021-21353Pug is an npm package which is a high-performance template e…9
• CVE-2021-21354Pollbot is open source software which "frees its human maste…6.1
• CVE-2021-21355TYPO3 is an open source PHP based web content management sys…8.6
• CVE-2021-21357TYPO3 is an open source PHP based web content management sys…8.3