CVE-2021-43859

Published: Feb 1, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Affected (19)

Products: Jenkins: Jenkins · Xstream: Xstream · Fedoraproject: Fedora · +2 more

Show all products

Jenkins: Jenkins · Xstream: Xstream · Fedoraproject: Fedora · Debian: Debian Linux · Oracle: Commerce Guided Search, Communications Brm Elastic Charging Engine, Communications Cloud Native Core Automated Test Suite, Communications Diameter Intelligence Hub, Communications Policy Management, Flexcube Private Banking, Retail Xstore Point Of Service

1 product

1 product

1 product

1 product

7 products

Commerce Guided Search

Communications Brm Elastic Charging Engine

Communications Cloud Native Core Automated Test Suite

Communications Diameter Intelligence Hub

Communications Policy Management

Flexcube Private Banking

Retail Xstore Point Of Service

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins Jenkins	Before 2.319.3
Jenkins Jenkins	From 2.321 to 2.334

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Xstream Xstream	Before 1.4.19

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration E

13 vulnerable

Vulnerable Software	Affected Versions
Oracle Commerce Guided Search	Version 11.3.2
Oracle Communications Brm Elastic Charging Engine	Before 12.0.0.4.6
Oracle Communications Brm Elastic Charging Engine	Version 12.0.0.5.0
Oracle Communications Cloud Native Core Automated Test Suite	Version 1.9.0
Oracle Communications Diameter Intelligence Hub	From 8.0.0 to 8.1.0
Oracle Communications Diameter Intelligence Hub	From 8.2.0 to 8.2.6
Oracle Communications Policy Management	Version 12.6.0.0.0
Oracle Flexcube Private Banking	Version 12.1.0
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Retail Xstore Point Of Service	Version 20.0.1