xstream vulnerabilities and fixes

Recent CVEs affecting xstream, with upgrade or downgrade steps. 35 tracked.

xstream has 35 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 35. Most recent: 2022-12-28. Highest priority: CVE-2021-39144 (score 90/100).

• CVE-2013-7285 CRITICAL 9.8 DOWNGRADE DOWNGRADE Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may a
• CVE-2021-39153 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39152 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39151 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39150 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39148 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39147 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39146 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39141 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39140 MEDIUM 6.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39139 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-29505 HIGH 7.5 UPGRADE MITIGATE XStream is software for serializing Java objects to XML and back again
• CVE-2021-39154 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39149 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-39145 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
• CVE-2021-21351 MEDIUM 5.4 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21350 MEDIUM 5.3 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21349 MEDIUM 6.1 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21348 MEDIUM 5.3 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21347 MEDIUM 6.1 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21346 MEDIUM 6.1 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21345 MEDIUM 5.8 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21344 MEDIUM 5.3 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21343 MEDIUM 5.3 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21342 MEDIUM 5.3 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2021-21341 HIGH 7.5 MITIGATE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2020-26259 MEDIUM 6.8 UPGRADE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2020-26258 MEDIUM 6.3 UPGRADE UPGRADE XStream is a Java library to serialize objects to XML and back again
• CVE-2020-26217 HIGH 8.0 UPGRADE MITIGATE XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote atta
• CVE-2022-41966 HIGH 8.2 UPGRADE XStream serializes Java objects to XML and back again
• CVE-2022-40152 MEDIUM 6.5 UPGRADE UPGRADE Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is
• CVE-2022-40151 MEDIUM 6.5 UPGRADE Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS)
• CVE-2021-43859 HIGH 7.5 UPGRADE UPGRADE XStream is an open source java library to serialize objects to XML and back again
• CVE-2021-39144 HIGH 8.5 EXPLOITED UPGRADE MITIGATE XStream Remote Code Execution Vulnerability
• CVE-2019-10173 CRITICAL 9.8 DOWNGRADE UPGRADE It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserializat

FAQ

How do I fix xstream vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is xstream being exploited right now?

Yes: 1 xstream CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which xstream CVE should I patch first?

CVE-2021-39144 currently ranks highest (90/100): XStream Remote Code Execution Vulnerability.

RSS feed for xstream · ← Back to latest CVEs