# com.thoughtworks.xstream:xstream (Maven) vulnerabilities 37 known vulnerabilities (20 high, 14 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.4.21 (Nov 7, 2024): no advisory affects it - Newest unaffected release: 1.4.21 (Nov 7, 2024), the latest release - Dependents: 2,377 - Releases: 46 since 0.1 (Sep 19, 2006) - Registry: https://central.sonatype.com/artifact/com.thoughtworks.xstream/xstream - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2024-47072: 0.1 to 1.4.20 (1.4.21 is outside it) - CVE-2022-41966: 0.1 to 1.4.19 (1.4.20 is outside it) - CVE-2022-40151: 0.1 to 1.4.19 (1.4.20 is outside it) - CVE-2021-43859: 0.1 to 1.4.18 (1.4.19 is outside it) - CVE-2021-39150: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39152: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39140: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39149: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39148: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39147: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39146: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39145: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39141: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39153: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39151: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39139: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39154: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-39144: 0.1 to 1.4.17 (1.4.18 is outside it) - CVE-2021-29505: 0.1 to 1.4.16 (1.4.17 is outside it) - CVE-2021-21348: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21349: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21350: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21351: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21341: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21342: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21343: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21344: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21345: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21346: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2021-21347: 0.1 to 1.4.15 (1.4.16 is outside it) - CVE-2020-26258: 0.1 to 1.4.14-jdk7 (1.4.15 is outside it) - CVE-2020-26259: 0.1 to 1.4.14-jdk7 (1.4.15 is outside it) - CVE-2020-26217: 0.1 to 1.4.14 (1.4.14-java7 is outside it) - CVE-2019-10173: 1.4.10 to 1.4.10-java7 (1.4.11 is outside it) - CVE-2013-7285: 0.1 to 1.4.6 (1.4.7 is outside it); 1.4.10 to 1.4.10-java7 (1.4.11 is outside it) - CVE-2017-7957: 0.1 to 1.4.9 (1.4.10 is outside it) - CVE-2016-3674: 0.1 to 1.4.8 (1.4.9 is outside it) ## Advisories (37) ### [CVE-2024-47072](https://cve.now/CVE-2024-47072): XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream - Severity: High 7.5 - Published: Nov 7, 2024 - Affected: fixed in 1.4.21. - Fixed in 1.4.21 (released Nov 7, 2024, the day of disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2022-41966](https://cve.now/CVE-2022-41966): XStream Denial of Service via stack overflow - Severity: High 8.2 - Published: Dec 27, 2022 - Affected: fixed in 1.4.20. - Fixed in 1.4.20 (released Dec 23, 2022, 4 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2022-40151](https://cve.now/CVE-2022-40151): Stack Buffer Overflow in xstream - Severity: Medium 6.5 - Published: Sep 16, 2022 - Affected: fixed in 1.4.20. - Fixed in 1.4.20 (released Dec 23, 2022, 98 days after disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-43859](https://cve.now/CVE-2021-43859): Denial of Service by injecting highly recursive collections or maps in XStream - Severity: High 7.5 - Published: Feb 1, 2022 - Affected: fixed in 1.4.19. - Fixed in 1.4.19 (released Jan 29, 2022, 3 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39150](https://cve.now/CVE-2021-39150): A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39152](https://cve.now/CVE-2021-39152): A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39140](https://cve.now/CVE-2021-39140): XStream can cause a Denial of Service - Severity: Medium 6.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39149](https://cve.now/CVE-2021-39149): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39148](https://cve.now/CVE-2021-39148): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39147](https://cve.now/CVE-2021-39147): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39146](https://cve.now/CVE-2021-39146): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39145](https://cve.now/CVE-2021-39145): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39141](https://cve.now/CVE-2021-39141): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39153](https://cve.now/CVE-2021-39153): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39151](https://cve.now/CVE-2021-39151): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39139](https://cve.now/CVE-2021-39139): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39154](https://cve.now/CVE-2021-39154): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: High 8.5 - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-39144](https://cve.now/CVE-2021-39144): XStream is vulnerable to a Remote Command Execution attack - Severity: High 8.5 ยท KEV - Published: Aug 23, 2021 - Affected: fixed in 1.4.18. - Fixed in 1.4.18 (released Aug 22, 2021, 1 day before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-29505](https://cve.now/CVE-2021-29505): XStream is vulnerable to a Remote Command Execution attack - Severity: High 7.5 - Published: May 28, 2021 - Affected: fixed in 1.4.17. - Fixed in 1.4.17 (released May 14, 2021, 14 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21348](https://cve.now/CVE-2021-21348): XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) - Severity: Medium 5.3 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21349](https://cve.now/CVE-2021-21349): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host - Severity: Medium 6.1 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21350](https://cve.now/CVE-2021-21350): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: Medium 5.3 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21351](https://cve.now/CVE-2021-21351): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: Medium 5.4 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21341](https://cve.now/CVE-2021-21341): XStream can cause a Denial of Service - Severity: High 7.5 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21342](https://cve.now/CVE-2021-21342): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host - Severity: Medium 5.3 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21343](https://cve.now/CVE-2021-21343): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights - Severity: Medium 5.3 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21344](https://cve.now/CVE-2021-21344): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: Medium 5.3 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21345](https://cve.now/CVE-2021-21345): XStream is vulnerable to a Remote Command Execution attack - Severity: Medium 5.8 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21346](https://cve.now/CVE-2021-21346): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: Medium 6.1 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2021-21347](https://cve.now/CVE-2021-21347): XStream is vulnerable to an Arbitrary Code Execution attack - Severity: Medium 6.1 - Published: Mar 22, 2021 - Affected: fixed in 1.4.16. - Fixed in 1.4.16 (released Mar 12, 2021, 10 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2020-26258](https://cve.now/CVE-2020-26258): Server-Side Forgery Request can be activated unmarshalling with XStream - Severity: Medium 6.3 - Published: Dec 16, 2020 - Affected: fixed in 1.4.15. - Fixed in 1.4.15 (released Dec 12, 2020, 4 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2020-26259](https://cve.now/CVE-2020-26259): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling - Severity: Medium 6.8 - Published: Dec 16, 2020 - Affected: fixed in 1.4.15. - Fixed in 1.4.15 (released Dec 12, 2020, 4 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2020-26217](https://cve.now/CVE-2020-26217): Remote Code Execution in XStream - Severity: High 8.0 - Published: Nov 16, 2020 - Affected: fixed in 1.4.14-java7. - Fixed in 1.4.14-java7 (released Nov 24, 2020, 8 days after disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2019-10173](https://cve.now/CVE-2019-10173): It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. - Severity: High 7.3 - Published: Jul 23, 2019 - Affected: from 1.4.10, fixed in 1.4.11. - Fixed in 1.4.11 (released Oct 22, 2018, 274 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2013-7285](https://cve.now/CVE-2013-7285): Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run - Severity: Unrated - Published: May 15, 2019 - Affected: fixed in 1.4.7; from 1.4.10, fixed in 1.4.11. - Fixed in 1.4.7 (released Feb 8, 2014, 1922 days before disclosure) and 1.4.11 (released Oct 22, 2018, 205 days before disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2017-7957](https://cve.now/CVE-2017-7957): XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'voi - Severity: Unrated - Published: Apr 29, 2017 - Affected: fixed in 1.4.10. - Fixed in 1.4.10 (released May 23, 2017, 24 days after disclosure). - The latest release, 1.4.21, is not affected. ### [CVE-2016-3674](https://cve.now/CVE-2016-3674): Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, - Severity: Unrated - Published: May 17, 2016 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Mar 15, 2016, 63 days before disclosure). - The latest release, 1.4.21, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.thoughtworks.xstream:xstream Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.