Security readout for executives and security teams
Plain-English summary
This affects applications using XStream before 1.4.18 to parse XML. A manipulated input stream can consume all CPU and make the service unavailable. The issue is availability-only, but can still disrupt customer-facing services or internal systems that deserialize attacker-controlled XML.
Executive priority
Treat as a moderate availability risk. Patch normal vulnerability management cycles, but accelerate for public, revenue-critical, or multi-tenant services that parse untrusted XML because exploitation can cause service disruption without data theft.
Technical view
XStream versions before 1.4.18 are vulnerable to denial of service through processed input manipulation, tied to unsafe deserialization behavior and an endless-loop condition. CVSS 3.1 is 6.5 with network attack vector, low complexity, privileges required, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely in Java applications, products, or packaged distributions that include x-stream XStream below 1.4.18 and deserialize XML from users, tenants, integrations, queues, or APIs. Systems using a strict XStream whitelist limited to required types are described as not affected.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. A remote attacker with required privileges may trigger excessive CPU consumption by influencing XML input processed by XStream. Impact is denial of service, not confidentiality or integrity compromise.
Researcher notes
Evidence supports affected x-stream XStream versions before 1.4.18, CWE-502 and CWE-835, and DoS impact only. The bundle names XStream 1.4.18 and whitelist-based security configuration; it does not provide proof of active exploitation or broader affected products beyond cited vendors.
Mitigation direction
- Upgrade XStream to 1.4.18 or a vendor package containing the fix.
- Enable XStream security framework with a minimal required-type whitelist.
- Update Debian, Fedora, Oracle, NetApp, or other affected packaged products per vendor advisories.
- Prioritize internet-facing or multi-tenant XML processing paths first.
- Check vendor guidance for embedded or transitive XStream copies.
Validation and detection
- Inventory direct and transitive XStream dependencies and identify versions below 1.4.18.
- Find application paths that deserialize XML from external or lower-trust sources.
- Confirm XStream whitelist configuration is enabled and limited to required types.
- Verify vendor packages include the referenced security update.
- Review monitoring for CPU saturation or availability incidents near XML parsing components.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39140 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxccCVE reference · x_refsource_CONFIRM
- https://x-stream.github.io/CVE-2021-39140.htmlCVE reference · x_refsource_MISC
- [debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security updateCVE reference · mailing-list, x_refsource_MLIST
- FEDORA-2021-fbad11014aCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-d894ca87dcCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-5e376c0ed9CVE reference · vendor-advisory, x_refsource_FEDORA
- DSA-5004CVE reference · vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210923-0003/CVE reference · x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.