CVE-2021-43859: Debian Linux

High severity, CVSS 7.5. EPSS: 7.9% chance of exploitation in the next 30 days.

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Jenkins Jenkins: before 2.319.3 (fixed in 2.319.3); from 2.321, before 2.334 (fixed in 2.334)
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Communications Brm - Elastic Charging Engine: before 12.0.0.4.6 (fixed in 12.0.0.4.6); version 12.0.0.5.0 only
• Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
• Oracle Communications Diameter Intelligence Hub: from 8.0.0, up to and including 8.1.0; from 8.2.0, up to and including 8.2.6
• Oracle Communications Policy Management: version 12.6.0.0.0 only
• Oracle Flexcube Private Banking: version 12.1.0 only
• Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only
• XStream XStream: before 1.4.19 (fixed in 1.4.19)

Published 2022-02-01. Last modified 2026-06-17.