Description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| x-stream | xstream | < 1.4.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | 1.4.14-1 | — |
| Debian 13 | libxstream-java | 1.4.14-1 | — |
| Debian 12 | libxstream-java | 1.4.14-1 | — |
| Debian 10 | libxstream-java | 1.4.11.1-1+deb10u1 | DSA-4811-1 |
| Debian 9 | libxstream-java | 1.4.9-2+deb9u1 | DLA-2471-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libxstream-java | 1.4.11.1-1ubuntu0.1 | USN-4943-1, USN-4714-1 |
| Ubuntu 18.04 LTS | libxstream-java | 1.4.11.1-1~18.04.1 | USN-4943-1, USN-4714-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libxstream-java | 1.4.8-1ubuntu0.1+esm3 | USN-6978-1 |
| Ubuntu Pro 14.04 LTS | libxstream-java | 1.4.7-1ubuntu0.1+esm2 | USN-6978-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | xstream +1 | 1.3.1-12.el7_9 | RHSA-2021:0162 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | xstream | 1.4.15-3.3.2 | SUSE-SU-2021:0176-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.1 | cobbler | 3.0.0+git20190806.32c4bae0-5.6.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | grafana-formula | 0.4.0-3.6.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | mgr-libmod | 4.1.7-3.16.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | mgr-osad | 4.1.5-2.9.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | prometheus-exporters-formula | 0.9.0-3.19.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | prometheus-formula | 0.3.1-3.6.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | py26-compat-salt | 2016.11.10-6.11.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | rhnlib | 4.1.3-4.3.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | smdba | 1.7.8-0.3.6.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-backend | 4.1.21-4.22.7 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-client-tools | 4.1.9-4.12.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-config | 4.1.5-3.3.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-java | 4.1.30-3.31.7 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-utils | 4.1.14-3.12.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | spacewalk-web | 4.1.23-3.18.6 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | subscription-matcher | 0.26-3.6.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | susemanager | 4.1.24-3.20.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | susemanager-doc-indexes | 4.1-11.28.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | susemanager-docs_en | 4.1-11.28.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | susemanager-schema | 4.1.19-3.24.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | susemanager-sls | 4.1.21-3.26.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | xpp3 | 1.1.4c-11.2.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Server Module 4.1 | xstream | 1.4.15-3.5.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | mgr-osad | 4.1.5-2.9.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | rhnlib | 4.1.3-4.3.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | spacewalk-backend | 4.1.21-4.22.7 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | spacewalk-client-tools | 4.1.9-4.12.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | spacewalk-proxy | 4.1.4-3.9.4 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | spacewalk-proxy-installer | 4.1.6-3.3.2 | SUSE-SU-2021:0906-1 |
| SUSE Manager Proxy Module 4.1 | spacewalk-web | 4.1.23-3.18.6 | SUSE-SU-2021:0906-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xstream | 1.4.18-1.1 | openSUSE-SU-2024:10592-1 |
| openSUSE Leap 15.2 | xstream | 1.4.15-lp152.2.3.1 | openSUSE-SU-2021:0140-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xstream +1 | 1.3.1-12.amzn2 | ALAS2-2021-1593 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | xstream +1 | 1.3.1-12.el7_9 | ELSA-2021-0162 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 5 repositories
-
novysodope/CVE-2020-26217-XStream-RCE-POC ★ 4 · Dec 8, 2020
CVE-2020-26217 XStream RCE POC
-
Al1ex/CVE-2020-26217 ★ 3 · Jan 22, 2021
CVE-2020-26217 && XStream RCE
-
shoucheng3/x-stream__xstream_CVE-2020-26217_1-4-14-java77 ★ 0 · Aug 23, 2025
-
cuijiung/xstream-CVE-2020-26217 ★ 0 · Jul 11, 2025
-
epicosy/XStream-1 ★ 0 · May 31, 2024
xstream with CVE-2020-26217
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- XStream <1.4.14 - Remote Code Execution http/cves/2020/CVE-2020-26217.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | < 1.4.14-java7 | 1.4.14-java7 | GHSA-mw36-7c6c-q4q2 |
Advisories 14
- RHSA-2021:0162 Red Hat Security Advisory: xstream security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- USN-6978-1 libxstream-java vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-4943-1 libxstream-java vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4811-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2471-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4714-1 libxstream-java vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10592-1 xstream-1.4.18-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0140-1 Security update for xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0176-1 Security update for xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0906-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-0094 Atlassian Bamboo: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2024
- ALAS2-2021-1593 Important: xstream security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 26, 2021
- ELSA-2021-0162 Important: xstream security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 19, 2021
References
- https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
- https://x-stream.github.io/CVE-2020-26217.html
- https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
- [debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security update mailing-list
- DSA-4811 vendor-advisory
- [activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217 mailing-list
- [activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217 mailing-list
- [activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210409-0004/
- https://www.oracle.com//security-alerts/cpujul2021.html
- [camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html