CVE-2021-39152: Debian Linux

High severity, CVSS 8.5. EPSS: 11.4% chance of exploitation in the next 30 days.

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

Affected products

  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
  • Netapp Snapmanager: affected versions not specified
  • Oracle Business Activity Monitoring: version 12.2.1.4.0 only
  • Oracle Commerce Guided Search: version 11.3.2 only
  • Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 11.3 only; version 12.0 only
  • Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
  • Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Unified Inventory Management: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only; version 7.4.2 only
  • Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only
  • Oracle Utilities Framework: version 4.2.0.2.0 only; version 4.2.0.3.0 only; version 4.3.0.1.0 only; version 4.3.0.6.0 only; version 4.4.0.0.0 only; version 4.4.0.2.0 only; …
  • Oracle Utilities Testing Accelerator: version 6.0.0.1.1 only
  • Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • XStream XStream: before 1.4.18 (fixed in 1.4.18)

Published 2021-08-23. Last modified 2026-10-07.