CVE-2021-21341
📋 TL;DR
CVE-2021-21341 is a denial-of-service vulnerability in XStream library where specially crafted XML input can cause 100% CPU consumption on target systems. Only users who haven't implemented XStream's security framework with a minimal type whitelist are affected. Users relying on default blacklists are vulnerable.
💻 Affected Systems
- XStream
- Applications using XStream library
📦 What is this software?
Activemq by Apache
Activemq by Apache
Activemq by Apache
Banking Enterprise Default Management by Oracle
View all CVEs affecting Banking Enterprise Default Management →
Banking Enterprise Default Management by Oracle
View all CVEs affecting Banking Enterprise Default Management →
Communications Billing And Revenue Management Elastic Charging Engine by Oracle
View all CVEs affecting Communications Billing And Revenue Management Elastic Charging Engine →
Communications Unified Inventory Management by Oracle
View all CVEs affecting Communications Unified Inventory Management →
Communications Unified Inventory Management by Oracle
View all CVEs affecting Communications Unified Inventory Management →
Communications Unified Inventory Management by Oracle
View all CVEs affecting Communications Unified Inventory Management →
Communications Unified Inventory Management by Oracle
View all CVEs affecting Communications Unified Inventory Management →
Communications Unified Inventory Management by Oracle
View all CVEs affecting Communications Unified Inventory Management →
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Jmeter by Apache
Xstream by Xstream
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to 100% CPU consumption, potentially affecting multiple systems if exploited in parallel
Likely Case
Degraded performance or temporary service disruption on affected systems processing malicious XML
If Mitigated
No impact for users who implemented proper type whitelisting as recommended
🎯 Exploit Status
Exploitation requires ability to submit XML input to XStream parser
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.16
Vendor Advisory: https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh
Restart Required: Yes
Instructions:
1. Update XStream dependency to version 1.4.16 or later
2. Update pom.xml or build.gradle to use XStream >=1.4.16
3. Redeploy application
4. Verify update with version check
🔧 Temporary Workarounds
Implement Type Whitelist
allConfigure XStream security framework with minimal required type whitelist instead of default blacklist
xstream.addPermission(new ExplicitTypePermission(new Class[]{YourAllowedClass.class}));
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all XML input
- Deploy network controls to limit XML processing to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check XStream version in application dependencies or classpathCheck Version:
java -cp "xstream-*.jar" com.thoughtworks.xstream.XStream --versionVerify Fix Applied:
Verify XStream version is 1.4.16 or higher in deployed application📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- XML parsing errors
- Application performance degradation
Network Indicators:
- Unusual XML payloads to application endpoints
- Repeated XML submissions
SIEM Query:
source="application.logs" AND ("CPU 100%" OR "XStream" OR "XML parsing")🔗 References
- http://x-stream.github.io/changes.html#1.4.16
- https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://security.netapp.com/advisory/ntap-20210430-0002/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://x-stream.github.io/CVE-2021-21341.html
- https://x-stream.github.io/security.html#workaround
- http://x-stream.github.io/changes.html#1.4.16
- https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://security.netapp.com/advisory/ntap-20210430-0002/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://x-stream.github.io/CVE-2021-21341.html
- https://x-stream.github.io/security.html#workaround
