CVE-2021-21342: Apache ActiveMQ
Critical severity, CVSS 9.1. EPSS: 50% chance of exploitation in the next 30 days.
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Affected products
- Apache ActiveMQ: before 5.15.14 (fixed in 5.15.14); version 5.16.0 only; version 5.16.1 only
- Apache Jmeter: before 5.5 (fixed in 5.5)
- Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
- Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
- Netapp Oncommand Insight: affected versions not specified
- Oracle Banking Enterprise Default Management: version 2.10.0 only; version 2.12.0 only
- Oracle Banking Platform: version 2.4.0 only; version 2.7.1 only; version 2.9.0 only; version 2.12.0 only
- Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
- Oracle Business Activity Monitoring: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Communications Brm - Elastic Charging Engine: version 12.0.0.3 only
- Oracle Communications Policy Management: version 12.5.0 only
- Oracle Communications Unified Inventory Management: version 7.3.2 only; version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only
- Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only
- Oracle Webcenter Portal: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
- XStream XStream: before 1.4.16 (fixed in 1.4.16)
Published 2021-03-23. Last modified 2026-10-07.