CVE-2021-21341: XStream XML deserialization allows remote CPU exhaustion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote, unauthenticated denial of service with a very high EPSS score and public exploit material, though impact is limited to availability and whitelist-configured deployments are unaffected.

What it is

XStream before 1.4.16 fails to control resource consumption when deserializing attacker-supplied XML, letting a crafted input stream consume 100% CPU on the target. The flaw is an uncontrolled resource consumption issue in the deserialization path, and it matters because any service that parses untrusted XML through XStream can be knocked over without authentication.

Impact

An attacker can exhaust CPU on the target host, degrading or halting the affected application and any co-located services. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.

Attack surface

Reached remotely over the network by submitting a malicious XML stream to an endpoint that deserializes with XStream; the vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. Systems that configured XStream's security framework with a minimal type whitelist are not affected.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.778 (99.5th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Upgrade XStream to version 1.4.16 or later, which is the fixed release.
• If upgrade is not immediately possible, apply the XStream security framework workaround and restrict deserialization to a whitelist of the minimal required types.
• Patch or update downstream products that bundle XStream, including Apache ActiveMQ, Apache JMeter, NetApp OnCommand Insight, Oracle WebCenter Portal and other listed Oracle and Debian/Fedora packages.
• Do not expose XML deserialization endpoints that use XStream's default blacklist to untrusted networks; place them behind authentication and network controls.
• Monitor CPU saturation on hosts running XStream-based services and rate-limit or block oversized or malformed XML payloads.

Detection

• Alert on sustained near-100% CPU on hosts running XStream-based applications, correlated with inbound XML requests.
• Log and inspect XML payloads sent to deserialization endpoints for unusually large or deeply nested structures.
• Inventory applications and dependencies for XStream versions below 1.4.16, including transitive copies in ActiveMQ, JMeter and vendor products.
• Watch for repeated or parallel requests to the same deserialization endpoint from a single source, which the advisory notes can amplify the effect.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.