CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-43859

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.052

EPSS Ranking 89.3%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.0

References

Products affected by CVE-2021-43859

Oracle » Commerce Guided Search » Version: 11.3.2

cpe:2.3:a:oracle:commerce_guided_search:11.3.2
Oracle » Communications Brm - Elastic Charging Engine » Version: 11.3

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3
Oracle » Communications Brm - Elastic Charging Engine » Version: 11.3.0.9.0

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0
Oracle » Communications Brm - Elastic Charging Engine » Version: 12

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12
Oracle » Communications Brm - Elastic Charging Engine » Version: 12.0

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0
Oracle » Communications Brm - Elastic Charging Engine » Version: 12.0.0.3

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3
Oracle » Communications Brm - Elastic Charging Engine » Version: 12.0.0.5.0

cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0
Oracle » Communications Cloud Native Core Automated Test Suite » Version: 1.9.0

cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.0.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.1.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.3

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3
Oracle » Communications Policy Management » Version: 12.6.0.0.0

cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0
Oracle » Flexcube Private Banking » Version: 12.1.0

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0
Oracle » Retail Xstore Point Of Service » Version: 16.0.6

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6
Oracle » Retail Xstore Point Of Service » Version: 17.0.4

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4
Oracle » Retail Xstore Point Of Service » Version: 18.0.3

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3
Oracle » Retail Xstore Point Of Service » Version: 19.0.2

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2
Oracle » Retail Xstore Point Of Service » Version: 20.0.1

cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1
Xstream Project » Xstream » Version: N/A

cpe:2.3:a:xstream_project:xstream:-
Xstream Project » Xstream » Version: 0.2

cpe:2.3:a:xstream_project:xstream:0.2
Xstream Project » Xstream » Version: 0.3

cpe:2.3:a:xstream_project:xstream:0.3
Xstream Project » Xstream » Version: 0.4

cpe:2.3:a:xstream_project:xstream:0.4
Xstream Project » Xstream » Version: 0.5

cpe:2.3:a:xstream_project:xstream:0.5
Xstream Project » Xstream » Version: 0.6

cpe:2.3:a:xstream_project:xstream:0.6
Xstream Project » Xstream » Version: 1.0

cpe:2.3:a:xstream_project:xstream:1.0
Xstream Project » Xstream » Version: 1.0.1

cpe:2.3:a:xstream_project:xstream:1.0.1
Xstream Project » Xstream » Version: 1.0.2

cpe:2.3:a:xstream_project:xstream:1.0.2
Xstream Project » Xstream » Version: 1.1

cpe:2.3:a:xstream_project:xstream:1.1
Xstream Project » Xstream » Version: 1.1.1

cpe:2.3:a:xstream_project:xstream:1.1.1
Xstream Project » Xstream » Version: 1.1.2

cpe:2.3:a:xstream_project:xstream:1.1.2
Xstream Project » Xstream » Version: 1.1.3

cpe:2.3:a:xstream_project:xstream:1.1.3
Xstream Project » Xstream » Version: 1.2

cpe:2.3:a:xstream_project:xstream:1.2
Xstream Project » Xstream » Version: 1.2.1

cpe:2.3:a:xstream_project:xstream:1.2.1
Xstream Project » Xstream » Version: 1.2.2

cpe:2.3:a:xstream_project:xstream:1.2.2
Xstream Project » Xstream » Version: 1.3

cpe:2.3:a:xstream_project:xstream:1.3
Xstream Project » Xstream » Version: 1.3.1

cpe:2.3:a:xstream_project:xstream:1.3.1
Xstream Project » Xstream » Version: 1.4

cpe:2.3:a:xstream_project:xstream:1.4
Xstream Project » Xstream » Version: 1.4.1

cpe:2.3:a:xstream_project:xstream:1.4.1
Xstream Project » Xstream » Version: 1.4.10

cpe:2.3:a:xstream_project:xstream:1.4.10
Xstream Project » Xstream » Version: 1.4.11

cpe:2.3:a:xstream_project:xstream:1.4.11
Xstream Project » Xstream » Version: 1.4.11.1

cpe:2.3:a:xstream_project:xstream:1.4.11.1
Xstream Project » Xstream » Version: 1.4.12

cpe:2.3:a:xstream_project:xstream:1.4.12
Xstream Project » Xstream » Version: 1.4.13

cpe:2.3:a:xstream_project:xstream:1.4.13
Xstream Project » Xstream » Version: 1.4.14

cpe:2.3:a:xstream_project:xstream:1.4.14
Xstream Project » Xstream » Version: 1.4.15

cpe:2.3:a:xstream_project:xstream:1.4.15
Xstream Project » Xstream » Version: 1.4.16

cpe:2.3:a:xstream_project:xstream:1.4.16
Xstream Project » Xstream » Version: 1.4.17

cpe:2.3:a:xstream_project:xstream:1.4.17
Xstream Project » Xstream » Version: 1.4.18

cpe:2.3:a:xstream_project:xstream:1.4.18
Xstream Project » Xstream » Version: 1.4.2

cpe:2.3:a:xstream_project:xstream:1.4.2
Xstream Project » Xstream » Version: 1.4.3

cpe:2.3:a:xstream_project:xstream:1.4.3
Xstream Project » Xstream » Version: 1.4.4

cpe:2.3:a:xstream_project:xstream:1.4.4
Xstream Project » Xstream » Version: 1.4.5

cpe:2.3:a:xstream_project:xstream:1.4.5
Xstream Project » Xstream » Version: 1.4.6

cpe:2.3:a:xstream_project:xstream:1.4.6
Xstream Project » Xstream » Version: 1.4.7

cpe:2.3:a:xstream_project:xstream:1.4.7
Xstream Project » Xstream » Version: 1.4.8

cpe:2.3:a:xstream_project:xstream:1.4.8
Xstream Project » Xstream » Version: 1.4.9

cpe:2.3:a:xstream_project:xstream:1.4.9
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0
Fedoraproject » Fedora » Version: 34

cpe:2.3:o:fedoraproject:fedora:34
Fedoraproject » Fedora » Version: 35

cpe:2.3:o:fedoraproject:fedora:35

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-43859

Products

Pricing

Contact Us