CVE-2021-21348: XStream is a Java library to serialize objects to XML and back again

Q: How do I fix CVE-2021-21348?

oncommand insight: mitigate or apply the listed mitigation; activemq: upgrade to 5.15.14; jmeter: upgrade to 5.5. Exact commands for each OS are on this page.

Q: Is CVE-2021-21348 being exploited?

CVE-2021-21348 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-21348 affect?

CVE-2021-21348 affects oncommand insight, activemq, jmeter. Severity is medium (CVSS 5.3). XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No u

Q: How urgent is CVE-2021-21348?

Priority 48/100. EPSS top 3%: very likely to be exploited; On your watchlist

This week

MEDIUM 5.3WATCHLISTMITIGATEUPGRADEUPGRADE

CVE-2021-21348 is a medium-severity flaw (CVSS 5.3) affecting oncommand insight, activemq, jmeter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framewor

Why this priority

EPSS top 3%: very likely to be exploited
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	Required
EPSS exploit chance	13.8% (top 3%)
CISA exploited list	No
Weakness	CWE-400, CWE-502
Published	2021-03-23
Last modified	2026-10-07

Publisher (CNA): GitHub, Inc. · Vendor: apache · debian · fedoraproject · netapp · xstream

Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-03-23 00:15 UTCPublished CVE record published
2026-10-07 19:17 UTCUpdated Record last modified

netapp oncommand insight MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy oncommand-insight || rpm -q oncommand-insight || oncommand-insight --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

apache activemq UPGRADE

Affected: < 5.15.14 · 5.16.0 · 5.16.1

Fixed in: 5.15.14

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy activemq || rpm -q activemq || activemq --version

2. UPGRADE to 5.15.14 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade activemq

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade activemq

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

apache jmeter UPGRADE

Affected: < 5.5

Fixed in: 5.5

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy jmeter || rpm -q jmeter || jmeter --version

2. UPGRADE to 5.5 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade jmeter

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade jmeter

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

xstream xstream UPGRADE

Affected: < 1.4.16

Fixed in: 1.4.16

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy xstream || rpm -q xstream || xstream --version

2. UPGRADE to 1.4.16 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade xstream

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade xstream

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

debian debian linux MITIGATE

Affected: 9.0 · 10.0 · 11.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

fedoraproject fedora MITIGATE

Affected: 33 · 34 · 35

Fixed in: no fixed release known

Safe to downgrade to: a release before 33

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-21348?

oncommand insight: mitigate or apply the listed mitigation; activemq: upgrade to 5.15.14; jmeter: upgrade to 5.5. Exact commands for each OS are on this page.

Is CVE-2021-21348 being exploited?

CVE-2021-21348 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-21348 affect?

CVE-2021-21348 affects oncommand insight, activemq, jmeter. Severity is medium (CVSS 5.3). XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No u

How urgent is CVE-2021-21348?

Priority 48/100. EPSS top 3%: very likely to be exploited; On your watchlist

Software pages

Java vulnerabilities · Debian vulnerabilities · Apache ActiveMQ vulnerabilities

Related CVEs

CVE-2022-43551 HIGH 7.5 UPGRADE MITIGATE A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP
CVE-2022-27778 HIGH 8.1 DOWNGRADE MITIGATE A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobbe
CVE-2021-36222 HIGH 7.5 UPGRADE MITIGATE ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.1
CVE-2021-22946 HIGH 7.5 UPGRADE MITIGATE A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP,
CVE-2021-22926 HIGH 7.5 UPGRADE MITIGATE libcurl-using applications can ask for a specific client certificate to be used in a transfer

References

← Back to latest CVEs