Skip to content
OpenAdvisories
High USN-4943-1 14 CVEs

libxstream-java vulnerabilities

Published May 11, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input stream. This issue only affected
Ubuntu 20.10. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service,
arbitrary code execution, arbitrary file deletion and server-side forgery
attacks. A remote attacker could cause any of those issues by manipulating
the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343
CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347,
CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS libxstream-java 1.4.11.1-1~18.04.2
Ubuntu · 20.04 LTS 20.04:LTS libxstream-java 1.4.11.1-1ubuntu0.2

Vulnerabilities 14

  • High 8.0
    CVE-2020-26217 Public exploit Scanner template EPSS 85%

    Remote Code Execution in XStream

    XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XS…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • High 7.5
    CVE-2021-21341 Public exploit EPSS 78%

    XStream can cause a Denial of Service

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.8
    CVE-2020-26259 Public exploit EPSS 82%

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know fi…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 6.3
    CVE-2020-26258 Public exploit Scanner template EPSS 82%

    Server-Side Forgery Request can be activated unmarshalling with XStream

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from interna…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21346 EPSS 76%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21347 EPSS 14%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21349 Public exploit EPSS 47%

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 5.8
    CVE-2021-21345 Public exploit Scanner template EPSS 72%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.4
    CVE-2021-21351 Scanner template EPSS 82%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21342 EPSS 50%

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21343 EPSS 47%

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21344 EPSS 76%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21348 EPSS 14%

    XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, wh…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21350 EPSS 15%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2020-26217
  • report
    https://ubuntu.com/security/CVE-2020-26258
  • report
    https://ubuntu.com/security/CVE-2020-26259
  • report
    https://ubuntu.com/security/CVE-2021-21341
  • report
    https://ubuntu.com/security/CVE-2021-21342
  • report
    https://ubuntu.com/security/CVE-2021-21343
  • report
    https://ubuntu.com/security/CVE-2021-21344
  • report
    https://ubuntu.com/security/CVE-2021-21345
  • report
    https://ubuntu.com/security/CVE-2021-21346
  • report
    https://ubuntu.com/security/CVE-2021-21347
  • report
    https://ubuntu.com/security/CVE-2021-21348
  • report
    https://ubuntu.com/security/CVE-2021-21349
  • report
    https://ubuntu.com/security/CVE-2021-21350
  • report
    https://ubuntu.com/security/CVE-2021-21351