CVE-2021-39144: XStream deserialization allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, has an EPSS probability above 98 percent, and yields remote code execution.

What it is

XStream, a Java library that serializes objects to and from XML, can execute host commands when a remote attacker with sufficient rights manipulates the processed input stream. The flaw is a deserialization/code injection issue (CWE-502, CWE-94) that only affects deployments that did not configure XStream's security framework with a minimal type whitelist; XStream 1.4.18 dropped the default blacklist because it cannot be secured for general use.

Impact

An attacker who can supply crafted XML to a vulnerable XStream instance can run arbitrary commands on the host, leading to full compromise of the application and its data.

Attack surface

Reached over the network (AV:N) by submitting a malicious serialized XML stream to an application that uses XStream without a whitelist; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-03-10 with a 2023-03-31 remediation due date, and EPSS gives a 30-day probability of 0.98124 (99.9th percentile); references are tagged Exploit, including a public VMware NSX Manager unauthenticated RCE write-up.

What to do

• Upgrade XStream to a fixed release and apply vendor patches for all affected products (Oracle, NetApp, Debian, Fedora) per their advisories.
• Configure XStream's security framework with a whitelist limited to the minimal required types, as the vendor recommends.
• Do not rely on the default blacklist; treat any XStream instance without a whitelist as exposed.
• Inventory applications and embedded libraries that bundle XStream, including third-party products, and confirm their patched status.
• Restrict network access to services that deserialize XML with XStream so untrusted input cannot reach them.

Detection

• Monitor application and web logs for XML payloads containing XStream class references or unexpected Java type names in deserialization requests.
• Alert on child process creation from Java application servers that normally do not spawn shells or system commands.
• Search for outbound or unusual network connections originating from hosts running XStream-based services.
• Check for the presence of vulnerable XStream versions in installed packages and application dependencies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.