{
  "cveId": "CVE-2021-21344",
  "url": "https://patchblox.com/security/cve/CVE-2021-21344",
  "summary": "CVE-2021-21344 is fixed in libxstream-java on 1 platform, first by libxstream-java 1.4.11.1-1~18.04.2, released March 22, 2021. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libxstream-java: XStream is a Java library to serialize objects to XML and back again",
  "description": "XStream is a Java library to serialize objects to XML and back again. InXStream before version 1.4.16, there is a vulnerability which may allow aremote attacker to load and execute arbitrary code from a remote host onlyby manipulating the processed input stream. No user is affected, whofollowed the recommendation to setup XStream\u0027s security framework with awhitelist limited to the minimal required types. If you rely on XStream\u0027sdefault blacklist of the Security Framework, you will have to use at leastversion 1.4.16.",
  "published": "2021-03-22T17:15:00Z",
  "severity": "Medium",
  "epss": 0.7598,
  "epssPercentile": 0.99532,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libxstream-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.11.1-1~18.04.2",
      "fix": "libxstream-java 1.4.11.1-1~18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libxstream-java-1.4.11.1-1-18.04.2",
      "released": "2021-03-22T17:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libxstream-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.4.11.1-1ubuntu0.2",
      "fix": "libxstream-java 1.4.11.1-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libxstream-java-1.4.11.1-1ubuntu0.2",
      "released": "2021-03-22T17:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libxstream-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.15-2",
      "fix": "libxstream-java 1.4.15-2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libxstream-java-1.4.15-2",
      "released": "2026-01-16T01:42:22Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}