CVE-2021-29505
HighXStream is vulnerable to a Remote Command Execution attack
Published May 18, 2021 · Updated Oct 9, 2026 · Also known as DEBIAN-CVE-2021-29505, DLA-2704-1, GHSA-7chv-rrw6-w6fc, SUSE-SU-2021:1995-1, TR-21-0575, TR-22-0143, UBUNTU-CVE-2021-29505
Key Facts
Patch immediately- CVE-2021-29505 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Snapmanager (Netapp), Banking Cash Management (Oracle), Banking Corporate Lending Process Management (Oracle) and 19 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 77% probability of exploitation in the next 30 days.
- Fixed versions are available, including com.thoughtworks.xstream:xstream 1.4.17, libxstream-java 1.4.11.1-1+deb9u3, libxstream-java 1.4.15-3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
77%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-29505 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Affected Products
85 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SnapmanagerNetapp | See advisory | n/a |
| Banking Cash ManagementOracle | 14.2, 14.3, 14.5 | n/a |
| Banking Corporate Lending Process ManagementOracle | 14.2.0, 14.3.0, 14.5.0 | n/a |
| Banking Credit Facilities Process ManagementOracle | 14.2.0, 14.3.0, 14.5.0 | n/a |
| Banking Supply Chain FinanceOracle | 14.2.0 | n/a |
Patched Releases
com.thoughtworks.xstream:xstream
1.4.17
libxstream-java
1.4.11.1-1+deb9u3, 1.4.15-3
Xstream
0:1.3.1-14.el7_9, 1.3.1-14.amzn2, 1.3.1-14.el7_9, 1.4.17-3.11.2, 1.4.17-lp152.2.9.1, 1.4.18-1.1, 1.4.17
xstream-benchmark
1.4.17-3.11.2, 1.4.17-lp152.2.9.1, 1.4.18-1.1
xstream-javadoc
1.3.1-14.amzn2, 1.3.1-14.el7_9, 1.4.17-3.11.2, 1.4.17-lp152.2.9.1, 1.4.18-1.1
xstream-parent
1.4.17-3.11.2, 1.4.17-lp152.2.9.1, 1.4.18-1.1
Timeline
Publicly disclosed
May 18, 2021
Last updated
Oct 9, 2026
Weakness Type
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-502 Deserialization of Untrusted Data
References
- advisoryRHSA-2021:2683
- advisoryRHSA-2021:4767
- advisoryRHSA-2021:4918
- advisoryRHSA-2022:0296
- advisoryRHSA-2022:0297
FAQ
Common Questions.
XStream is software for serializing Java objects to XML and back again.
Affected: Snapmanager (Netapp); Banking Cash Management (Oracle) versions 14.2, 14.3, 14.5; Banking Corporate Lending Process Management (Oracle) versions 14.2.0, 14.3.0, 14.5.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including com.thoughtworks.xstream:xstream 1.4.17, libxstream-java 1.4.11.1-1+deb9u3, libxstream-java 1.4.15-3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-29505 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo