CVE-2021-21346: Apache ActiveMQ

Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days.

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Affected products

  • Apache ActiveMQ: before 5.15.14 (fixed in 5.15.14); version 5.16.0 only; version 5.16.1 only
  • Apache Jmeter: before 5.5 (fixed in 5.5)
  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
  • Netapp Oncommand Insight: affected versions not specified
  • Oracle Banking Enterprise Default Management: version 2.10.0 only; version 2.12.0 only
  • Oracle Banking Platform: version 2.4.0 only; version 2.7.1 only; version 2.9.0 only; version 2.12.0 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle BI Publisher: version 5.5.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Business Activity Monitoring: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 12.0.0.3.0 only
  • Oracle Communications Policy Management: version 12.5.0 only
  • Oracle Communications Unified Inventory Management: version 7.3.2 only; version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only
  • Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only
  • Oracle Webcenter Portal: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • XStream XStream: before 1.4.16 (fixed in 1.4.16)

Published 2021-03-23. Last modified 2026-10-07.