CVE-2021-21349: XStream deserialization flaw enables SSRF against internal resources

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.6 with network reachability, no authentication or user interaction, and a very high EPSS percentile, though impact is limited to confidentiality and whitelist-configured deployments are unaffected.

What it is

XStream, a Java library for serializing objects to and from XML, before version 1.4.16 allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream. It is a deserialization of untrusted data issue that also manifests as server-side request forgery, so any application unmarshalling untrusted XML with XStream's default blacklist is exposed.

Impact

An attacker can cause the application to reach internal-only resources and read data that should not be publicly reachable, with high confidentiality impact but no integrity or availability impact.

Attack surface

Reached over the network by supplying crafted XML to an XStream deserialization endpoint; the CVSS vector shows no privileges and no user interaction required. Systems that configured XStream's security framework with a minimal whitelist are not affected.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is 0.46826 (98.8th percentile) and the vendor advisory reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade XStream to version 1.4.16 or later, which is the minimum required when relying on the default blacklist.
• Replace the default blacklist with a security framework whitelist limited to the minimal required types.
• Update dependent products that bundle XStream, including Apache ActiveMQ, Apache JMeter, NetApp OnCommand Insight, Oracle Java SE/GraalVM and Oracle banking and middleware products, per their vendor advisories.
• Apply distribution patches for Debian and Fedora packages that ship XStream.
• Restrict outbound network access from application servers so deserialization cannot reach internal-only services.

Detection

• Monitor application logs and network flows for outbound requests from XStream-based services to internal addresses or unexpected hosts.
• Alert on XML payloads containing XStream class and field elements that reference network or resource-loading types.
• Inventory deployed XStream versions and flag any instance below 1.4.16, including those embedded in ActiveMQ, JMeter and vendor products.
• Watch for repeated deserialization errors or unusual XML input sizes on endpoints that unmarshal XStream data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.