CVE-2021-21341: Denial of Service in com.thoughtworks.xstream:xstream
Summary
CVE-2021-21341: XStream can cause a Denial of Service. Affects com.thoughtworks.xstream:xstream versions < 1.4.16. Fixed in 1.4.16. How to fix ↓
Also tracked for
- activemq · Bitnami
- libxstream-java · Debian:11
The same CVE-2021-21341 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library used for serializing Java objects to XML and deserializing XML back to Java objects. It provides a simple API for converting Java objects to XML and vice versa. This vulnerability affects versions prior to 1.4.16 of the library.
Vulnerability Detail
The vulnerability in com.thoughtworks.xstream:xstream allows a remote attacker to cause a Denial of Service (DoS) by manipulating the processed input stream. By exploiting this vulnerability, an attacker can allocate 100% CPU time on the target system, potentially resulting in a complete system freeze. This vulnerability can be triggered by sending specially crafted input to the library.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not immediately feasible, you can implement a workaround by setting up XStream's security framework with a whitelist limited to the minimal required types. This can help mitigate the risk of exploitation. Refer to the XStream documentation for instructions on implementing this workaround.
Conclusion
CVE-2021-21341 is a Denial of Service vulnerability in com.thoughtworks.xstream:xstream. It can be mitigated by updating the library to version 1.4.16 or later. If immediate update is not possible, implementing a workaround by setting up XStream's security framework with a whitelist can help reduce the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source library used for serializing Java objects to XML and deserializing XML back to Java objects. It provides a simple API for converting Java objects to XML and vice versa.
The vulnerability allows a remote attacker to cause a Denial of Service (DoS) by manipulating the processed input stream. This can result in a complete system freeze or unresponsiveness.
To fix this vulnerability, update com.thoughtworks.xstream:xstream to version 1.4.16 or later. This version includes patches that address the DoS vulnerability.
Yes, if updating the library is not immediately feasible, you can implement a workaround by setting up XStream's security framework with a whitelist limited to the minimal required types. This can help mitigate the risk of exploitation.
The vulnerability was discovered and reported by threedr3am.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
