CVE-2021-43859

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-43859
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43859.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-43859
Aliases
Downstream
CGA (4)
CLSA (1)
DEBIAN (1)
OESA (2)
openSUSE (2)
RHSA (1)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2022-02-01T12:15:08Z
Modified
2026-10-24T07:14:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "2.319.3"
                        },
                        {
                            "introduced":  "2.321"
                        },
                        {
                            "fixed":  "2.334"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "jenkins:jenkins"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "12.0.0.4.6"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:communications_brm_-_elastic_charging_engine"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.0.0"
                        },
                        {
                            "last_affected":  "8.1.0"
                        },
                        {
                            "introduced":  "8.2.0"
                        },
                        {
                            "last_affected":  "8.2.6"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "oracle:communications_diameter_intelligence_hub"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "9.0"
                        },
                        {
                            "last_affected":  "9.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "34"
                        },
                        {
                            "last_affected":  "34"
                        },
                        {
                            "introduced":  "35"
                        },
                        {
                            "last_affected":  "35"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "11.3.2"
                        },
                        {
                            "last_affected":  "11.3.2"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:commerce_guided_search"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "12.0.0.5.0"
                        },
                        {
                            "last_affected":  "12.0.0.5.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:communications_brm_-_elastic_charging_engine"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.9.0"
                        },
                        {
                            "last_affected":  "1.9.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:communications_cloud_native_core_automated_test_suite"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "12.6.0.0.0"
                        },
                        {
                            "last_affected":  "12.6.0.0.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:communications_policy_management"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "12.1.0"
                        },
                        {
                            "last_affected":  "12.1.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:flexcube_private_banking"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "16.0.6"
                        },
                        {
                            "last_affected":  "16.0.6"
                        },
                        {
                            "introduced":  "17.0.4"
                        },
                        {
                            "last_affected":  "17.0.4"
                        },
                        {
                            "introduced":  "18.0.3"
                        },
                        {
                            "last_affected":  "18.0.3"
                        },
                        {
                            "introduced":  "19.0.2"
                        },
                        {
                            "last_affected":  "19.0.2"
                        },
                        {
                            "introduced":  "20.0.1"
                        },
                        {
                            "last_affected":  "20.0.1"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "oracle:retail_xstore_point_of_service"
        }
    ]
}
References

Affected packages

Git / github.com/x-stream/xstream

Affected ranges

Type
GIT
Repo
https://github.com/x-stream/xstream
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
61a00fa225dc99488013869b57b772af8e2fea03
Fixed
e8e88621ba1c85ac3b8620337dd672e0c0c3a846
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.4.19"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "e8e88621ba1c85ac3b8620337dd672e0c0c3a846"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
XSTREAM_1_4_10
XSTREAM_1_4_11
XSTREAM_1_4_11_1
XSTREAM_1_4_12
XSTREAM_1_4_13
XSTREAM_1_4_14
XSTREAM_1_4_15
XSTREAM_1_4_16
XSTREAM_1_4_17
XSTREAM_1_4_18
XSTREAM_1_4_5
XSTREAM_1_4_9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43859.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "55566688760790417229342517075763677048",
            "length":  181
        },
        "id":  "CVE-2021-43859-29d87ff6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java",
            "function":  "testInstanceOfVoid"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "261717738691877522929827956336707666449",
            "length":  158
        },
        "id":  "CVE-2021-43859-3b92b93a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/collections/CollectionConverter.java",
            "function":  "addCurrentElementToCollection"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "17231138287832600381894592100287068069",
            "length":  381
        },
        "id":  "CVE-2021-43859-42b4ae14",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/core/TreeUnmarshaller.java",
            "function":  "convert"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "220166040034801707177840403453687177859",
            "length":  650
        },
        "id":  "CVE-2021-43859-43f10a94",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java",
            "function":  "testCannotInjectEventHandler"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "37669725065981372541361920149060037669",
                "1754229239276929498699274070455340911",
                "41982352291054190134426946505239413600",
                "339132426552016436555085584248404447229",
                "281190335896921026067654418042948691705",
                "101836451350065470669588115209640466933",
                "170069226330896549956587004495602417294",
                "175405664480641811482846628989242555461",
                "308344043568311556500843217578373648934",
                "214661633136529325303486917787961611567",
                "57524199966063753519088560374134026781",
                "63361542330210864932936498280080202040",
                "121377978789604838791055385342124703054",
                "120564178264636159261842547107268022221",
                "280309282135332622366291820899588071183",
                "116140396242623306064878654562145661014",
                "228659153108235947882753463685898110017",
                "253465008515736530894371217708547114895",
                "47604041726619113582236911670478212984",
                "157827691179106628380218623395528602742",
                "299357159731611816879190520786090623494",
                "263325449489108397308033639618897227089",
                "195855868307017984720518213082419999218",
                "157827691179106628380218623395528602742",
                "56570557617033010041633030400660432580",
                "266269599569454697175169268514228635384"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-48fd1814",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "158675721028694727290893110113569592667",
            "length":  372
        },
        "id":  "CVE-2021-43859-59287a06",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/XStream.java",
            "function":  "unmarshal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "86104287393050438777889317149321611565",
            "length":  219
        },
        "id":  "CVE-2021-43859-827b0ed4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/collections/MapConverter.java",
            "function":  "putCurrentEntryIntoMap"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "47133092775335648767215388072869838081",
                "72897891070941714057763968897150290546",
                "204876188397446628625129180757218716667",
                "183977537466193036774603040383124982900",
                "108738211081595398246856293798472960621",
                "17550906770456504535387592149065180578",
                "160816637933070719777862874531377453485",
                "131320530687662887544912643709547885866",
                "79469178477997099640743731152801113345"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-840ebf27",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/extended/NamedMapConverter.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "7616263090923437985525346265549616761",
                "211219839203299185987365307554810409985",
                "73721228261296255058296875540290052237",
                "239913871774152437040395752063489313149",
                "117725265296903224689269951407431455617",
                "126617756455122379474158532832345634375",
                "158235987049869476657084451570586380240",
                "314118849962306354916524331560040293068",
                "96433297052028480260787407611872064849",
                "325820611125133184921877174183212096326",
                "275047211673991781190008335997426805456",
                "251899931567808305004438430281872370011",
                "177754559542579598598790658770667215612",
                "118738670761640002657491233549629791713",
                "71362147945938633015783245649742152827",
                "239637841955745921799253626664476578801",
                "136908090792826903881571180858786345652",
                "226208401357142230571642567540990195204",
                "5923312382624037816122342231039016977",
                "256450194889914305419909032943252724007",
                "209578339882724276781126381994571211439",
                "207821519896740168085970131722419024131",
                "89998112668629298309028616244523277223",
                "257848222184230265269703082711942417201",
                "231035764628361720499571828605484840546",
                "48705185870131617258729178622391399075",
                "334353687146338771572110171878246600462",
                "164655022164759611606439376066928116229",
                "38013853609415735731977596616628687320"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-9f4d057d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/XStream.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "228474360994162782889542199712320720945",
            "length":  1357
        },
        "id":  "CVE-2021-43859-ad6928e4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/extended/NamedMapConverter.java",
            "function":  "populateMap"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "67983786004786075010774811532640513342",
                "155251688185425872193164153142665759940",
                "180982352636348001737525535511897856621",
                "291635795756997543440780842469637458131",
                "100411840036841395080916223528854409368",
                "45659907922294160967612934064248224018",
                "31472221394269137905746344083408247215",
                "88563598898606841684968123180300453216"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-ad72fdf2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/collections/MapConverter.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "185869447222012862197413743734267332963",
                "274937438635320053675547534042926965660",
                "212113714018905300703044115447665097447",
                "315082099377130877878551267537102060517",
                "322595832639141750214961352993266288428",
                "288516566081390833032506510066468270740",
                "6674929763605018183272915908570643204",
                "256753108423566523410138376942892651005"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-b91b8836",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/converters/collections/CollectionConverter.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "136451740817690776813850310762997082518",
                "105753953192027108849418635246114421000",
                "118882738501084926826075990972404281301",
                "212020063483191151362987575288808695462",
                "287333414921625036090543832290154043373",
                "9891789946521726045761755493407333519",
                "5559154755073053156556721280319387054",
                "238112864466872781268528486106920449733"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-ccb9a04c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/core/TreeUnmarshaller.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "11964886622017048364241710368819996484",
            "length":  219
        },
        "id":  "CVE-2021-43859-cf16e600",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/XStream.java",
            "function":  "readFromStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "12709619694192487888878944821281014679",
            "length":  873
        },
        "id":  "CVE-2021-43859-df4b16d4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/XStream.java",
            "function":  "createObjectInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "253499341416318301251134402216259344937",
            "length":  401
        },
        "id":  "CVE-2021-43859-e2dd41b1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java",
            "function":  "testCannotUseJaxwsInputStreamToDeleteFile"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "302436115647464791492807424592955265526",
                "20337160572719266553945974133231939115",
                "100606639916437884206076948162615070323"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-43859-f898dd1d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846",
        "target":  {
            "file":  "xstream/src/java/com/thoughtworks/xstream/security/ForbiddenClassException.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T07:14:33Z"