CVE-2021-39140

XStream is a simple library to serialize objects to XML and back again. In
affected versions this vulnerability may allow a remote attacker to
allocate 100% CPU time on the target system depending on CPU type or
parallel execution of such a payload resulting in a denial of service only
by manipulating the processed input stream. No user is affected, who
followed the recommendation to setup XStream’s security framework with a
whitelist limited to the minimal required types. XStream 1.4.18 uses no
longer a blacklist by default, since it cannot be secured for general
purpose.

Notes