EUVD-2021-0673

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

XStream before version 1.4.16 has a vulnerability allowing object manipulation during unmarshalling.

Reporter	Title	Published	Views	Family All 115
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream	26 Jul 202206:38	–	ibm
IBM Security Bulletins	Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating	13 Apr 202121:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in xstream-1.4.9.jar	29 Jan 202517:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js affect IBM Spectrum Control	20 May 202108:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus	28 Jun 202120:25	–	ibm
IBM Security Bulletins	Security Bulletin: XStream (Publicly disclosed vulnerability)	23 Aug 202105:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	8 Jul 202119:08	–	ibm

[
  {
    "enisaIdVendor": [
      {
        "id": "0cc942fb-2902-3529-a754-2cf388a2817b",
        "vendor": {
          "name": "x-stream"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "03eb397c-64e1-370d-a49c-af5c0cd8a9b2",
        "product": {
          "name": "xstream"
        },
        "product_version": "< 1.4.16"
      }
    ]
  }
]

Source	Link
github	www.github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21342
github	www.github.com/x-stream/xstream
lists	www.lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
lists	www.lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2021/04/msg00002.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
security	www.security.netapp.com/advisory/ntap-20210430-0002

07 Oct 2025 00:30Current

7.2High risk

Vulners AI Score7.2

CVSS 3.15.3 - 9.1

CVSS 25.8

EPSS0.00869