ZeroDay Findings
Sign inSign up

Findings

CVE-2021-39144

XStream Remote Code Execution Vulnerability

Published Aug 23, 2021 · updated Jun 16, 2026 · xstream xstream

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 23, 2021 · Catalog

    Detected

    XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.

  2. Mar 10, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 31, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.

Required action

Apply updates per vendor instructions.

CISA due date Mar 31, 2023

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora34
  • cpe fedoraproject/fedora35
  • cpe netapp/snapmanagerversion unspecified
  • cpe oracle/business activity monitoring12.2.1.4.0
  • cpe xstream/xstreamversion unspecified
  • vendor XStream XStreamversion unspecified

Sources

  • CISA KEVCVE-2021-39144

    XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.

    cisa.gov
  • CVE.orgCVE-2021-39144

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-39144

    30-day exploitation probability 98.1%

    first.org
  • Metasploit Modulesexploit_linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-39144

    XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2021-39144 · ZeroDay Findings