CVE-2021-43859

Name: CVE-2021-43859
Creator: NVD / NIST
Published: 2022-02-01T12:15:08.08+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 8.15%

Last modified Jun 17, 2026

CVE-2021-43859 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. EPSS estimates a 8.15% chance of exploitation in the next 30 days.

Description

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

8.15%

94.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Jenkins	Jenkins	< 2.319.3
Jenkins	Jenkins	>= 2.321, < 2.334
Xstream	Xstream	< 1.4.19
Fedoraproject	Fedora	34
Fedoraproject	Fedora	35
Debian	Debian Linux	9.0
Oracle	Commerce Guided Search	11.3.2
Oracle	Communications Brm - Elastic Charging Engine	< 12.0.0.4.6
Oracle	Communications Brm - Elastic Charging Engine	12.0.0.5.0
Oracle	Communications Cloud Native Core Automated Test Suite	1.9.0
Oracle	Communications Diameter Intelligence Hub	>= 8.0.0, <= 8.1.0
Oracle	Communications Diameter Intelligence Hub	>= 8.2.0, <= 8.2.6
Oracle	Communications Policy Management	12.6.0.0.0
Oracle	Flexcube Private Banking	12.1.0
Oracle	Retail Xstore Point Of Service	16.0.6
Oracle	Retail Xstore Point Of Service	17.0.4
Oracle	Retail Xstore Point Of Service	18.0.3
Oracle	Retail Xstore Point Of Service	19.0.2
Oracle	Retail Xstore Point Of Service	20.0.1

References

http://www.openwall.com/lists/oss-security/2022/02/09/1Mailing List, Third Party Advisory
https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846Patch, Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjfExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00018.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/Mailing List
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://x-stream.github.io/CVE-2021-43859.htmlExploit, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/02/09/1Mailing List, Third Party Advisory
https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846Patch, Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjfExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/Mailing List
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://x-stream.github.io/CVE-2021-43859.htmlExploit, Vendor Advisory

Timeline

Published: Feb 1, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-43859?

How severe is CVE-2021-43859?

CVE-2021-43859 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 8.15% probability of exploitation in the next 30 days.

How do I fix CVE-2021-43859?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-43859?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST