CVE-2021-21342: Server-Side Forgery Request in com.thoughtworks.xstream:xstream
Summary
CVE-2021-21342: Impact The processed stream at unmarshalling time contains type information to recreate the formerly written objects. Affects com.thoughtworks.xstream:xstream versions < 1.4.16. Fixed in 1.4.16. How to fix ↓
Also tracked for
- activemq · Bitnami
- libxstream-java · Debian:11
The same CVE-2021-21342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library for serializing Java objects to XML and back. It provides a simple API for converting objects to XML and vice versa. This vulnerability affects versions prior to 1.4.16 of the library. The library is vulnerable to a Server-Side Forgery Request, which can be activated by unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host.
Vulnerability Detail
The vulnerability occurs during the unmarshalling process in XStream, where the processed stream contains type information to recreate the formerly written objects. XStream creates new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, resulting in a server-side forgery request. This can lead to unauthorized access to sensitive data or actions on behalf of the server. Users who have followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the latest version of com.thoughtworks.xstream:xstream, you can implement a workaround by following the steps provided in the XStream documentation for CVE-2021-21342. The workaround involves modifying the XStream configuration to restrict the allowed types and prevent the exploitation of the vulnerability.
Conclusion
The com.thoughtworks.xstream:xstream library prior to version 1.4.16 is vulnerable to a Server-Side Forgery Request. It is recommended to update the library to the latest version or implement the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source library for serializing Java objects to XML and back. It provides a simple API for converting objects to XML and vice versa.
The vulnerability allows an attacker to manipulate the processed input stream during unmarshalling and perform server-side forgery requests. This can lead to unauthorized access to sensitive data or actions on behalf of the server.
To fix this vulnerability, update the com.thoughtworks.xstream:xstream library to version 1.4.16 or later. Alternatively, follow the provided workaround steps in the XStream documentation.
There are no known exploits of this vulnerability at the moment. However, it is important to update the library or implement the workaround to prevent potential exploitation.
The vulnerability was discovered and reported by 钟潦贵 (Liaogui Zhong) to XStream. They provided the required information to reproduce the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
