CVE-2021-21349: Apache ActiveMQ

High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days.

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Affected products

  • Apache ActiveMQ: before 5.15.14 (fixed in 5.15.14); version 5.16.0 only; version 5.16.1 only
  • Apache Jmeter: before 5.5 (fixed in 5.5)
  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
  • Netapp Oncommand Insight: affected versions not specified
  • Oracle Banking Enterprise Default Management: version 2.10.0 only; version 2.12.0 only
  • Oracle Banking Platform: version 2.4.0 only; version 2.7.1 only; version 2.9.0 only; version 2.12.0 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Business Activity Monitoring: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 12.0.0.3.0 only
  • Oracle Communications Policy Management: version 12.5.0 only
  • Oracle Communications Unified Inventory Management: version 7.3.2 only; version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only
  • Oracle Graalvm: version 20.3.4 only; version 21.3.0 only
  • Oracle Java SE: version 7u321 only; version 8u311 only
  • Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only
  • Oracle Webcenter Portal: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • XStream XStream: before 1.4.16 (fixed in 1.4.16)

Published 2021-03-23. Last modified 2026-10-07.