Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.thoughtworks.xstream:xstream

37 known vulnerabilities (20 high, 14 medium), with the versions each affects and the releases that fix them.

Latest release
1.4.21 (Nov 7, 2024): no advisory affects it
Newest unaffected release
1.4.21 (Nov 7, 2024), the latest release
Advisories
37 · 20 high, 14 medium
Dependents
2,377
Releases
46 since 0.1 (Sep 19, 2006)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Show all 37 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 37

  • XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

    Affected: fixed in 1.4.21.

    Fixed in 1.4.21 (released Nov 7, 2024, the day of disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream Denial of Service via stack overflow

    Affected: fixed in 1.4.20.

    Fixed in 1.4.20 (released Dec 23, 2022, 4 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2022-40151Medium 6.5

    Stack Buffer Overflow in xstream

    Affected: fixed in 1.4.20.

    Fixed in 1.4.20 (released Dec 23, 2022, 98 days after disclosure).

    The latest release, 1.4.21, is not affected.

  • Denial of Service by injecting highly recursive collections or maps in XStream

    Affected: fixed in 1.4.19.

    Fixed in 1.4.19 (released Jan 29, 2022, 3 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-39140Medium 6.5

    XStream can cause a Denial of Service

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

Show all 37 advisoriesShow fewer advisories

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-39144High 8.5 · KEV

    XStream is vulnerable to a Remote Command Execution attack

    Affected: fixed in 1.4.18.

    Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream is vulnerable to a Remote Command Execution attack

    Affected: fixed in 1.4.17.

    Fixed in 1.4.17 (released May 14, 2021, 14 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21348Medium 5.3

    XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21349Medium 6.1

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21350Medium 5.3

    XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21351Medium 5.4

    XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream can cause a Denial of Service

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21342Medium 5.3

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21343Medium 5.3

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21344Medium 5.3

    XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21345Medium 5.8

    XStream is vulnerable to a Remote Command Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21346Medium 6.1

    XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2021-21347Medium 6.1

    XStream is vulnerable to an Arbitrary Code Execution attack

    Affected: fixed in 1.4.16.

    Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2020-26258Medium 6.3

    Server-Side Forgery Request can be activated unmarshalling with XStream

    Affected: fixed in 1.4.15.

    Fixed in 1.4.15 (released Dec 12, 2020, 4 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • CVE-2020-26259Medium 6.8

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

    Affected: fixed in 1.4.15.

    Fixed in 1.4.15 (released Dec 12, 2020, 4 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • Remote Code Execution in XStream

    Affected: fixed in 1.4.14-java7.

    Fixed in 1.4.14-java7 (released Nov 24, 2020, 8 days after disclosure).

    The latest release, 1.4.21, is not affected.

  • It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

    Affected: from 1.4.10, fixed in 1.4.11.

    Fixed in 1.4.11 (released Oct 22, 2018, 274 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run

    Affected: fixed in 1.4.7; from 1.4.10, fixed in 1.4.11.

    Fixed in 1.4.7 (released Feb 8, 2014, 1922 days before disclosure) and 1.4.11 (released Oct 22, 2018, 205 days before disclosure).

    The latest release, 1.4.21, is not affected.

  • XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'voi

    Affected: fixed in 1.4.10.

    Fixed in 1.4.10 (released May 23, 2017, 24 days after disclosure).

    The latest release, 1.4.21, is not affected.

  • Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver,

    Affected: fixed in 1.4.9.

    Fixed in 1.4.9 (released Mar 15, 2016, 63 days before disclosure).

    The latest release, 1.4.21, is not affected.