CVE-2021-39140: Denial of Service Vulnerability in com.thoughtworks.xstream:xstream
Summary
CVE-2021-39140: XStream can cause a Denial of Service. Affects com.thoughtworks.xstream:xstream versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2021-39140 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library for serializing Java objects to XML and deserializing XML back into objects. It provides a simple API for converting Java objects to XML and vice versa. The library is widely used in various applications and frameworks for data serialization and deserialization. However, it is vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in com.thoughtworks.xstream:xstream, identified as CVE-2021-39140, allows a remote attacker to cause a DoS attack by manipulating the processed input stream. By exploiting this vulnerability, an attacker can allocate 100% CPU time on the target system, potentially leading to a complete system freeze or unresponsiveness. The impact of the attack depends on the CPU type or parallel execution of the payload. Users who have followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected by this vulnerability.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by following the steps provided in the XStream documentation for the specific version. The documentation provides detailed instructions on how to mitigate the vulnerability and protect the system from potential DoS attacks. It is recommended to review the documentation and apply the appropriate workaround based on the version of com.thoughtworks.xstream:xstream being used.
Conclusion
CVE-2021-39140 is a Denial of Service vulnerability in com.thoughtworks.xstream:xstream. By manipulating the processed input stream, a remote attacker can cause a system freeze or unresponsiveness by consuming 100% CPU time. It is crucial to update to version 1.4.18 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing the recommended workaround from the XStream documentation is advised. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source library for serializing Java objects to XML and deserializing XML back into objects. It is widely used in various applications and frameworks for data serialization and deserialization.
The vulnerability allows a remote attacker to cause a DoS attack by manipulating the processed input stream. This can result in a complete system freeze or unresponsiveness, depending on the CPU type or parallel execution of the payload.
The vulnerability was discovered and reported by Lai Han of nsfocus security team.
To fix this vulnerability, it is recommended to update com.thoughtworks.xstream:xstream to version 1.4.18 or later. This patched version addresses the vulnerability and mitigates the risk of a DoS attack.
No, users who have followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
