CVE-2021-43859

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-43859
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-43859.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-43859
Aliases
Downstream
Related
Published
2022-02-01T12:15:08.080Z
Modified
2026-05-15T12:14:09.909046608Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "last_affected": "9.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
            ],
            "vendor_product": "fedoraproject:fedora",
            "extracted_events": [
                {
                    "last_affected": "34"
                },
                {
                    "last_affected": "35"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:commerce_guided_search",
            "extracted_events": [
                {
                    "last_affected": "11.3.2"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:communications_brm_-_elastic_charging_engine",
            "extracted_events": [
                {
                    "fixed": "12.0.0.4.6"
                },
                {
                    "last_affected": "12.0.0.5.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:communications_cloud_native_core_automated_test_suite",
            "extracted_events": [
                {
                    "last_affected": "1.9.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:communications_diameter_intelligence_hub",
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.1.0"
                },
                {
                    "introduced": "8.2.0"
                },
                {
                    "last_affected": "8.2.6"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:communications_policy_management",
            "extracted_events": [
                {
                    "last_affected": "12.6.0.0.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:flexcube_private_banking",
            "extracted_events": [
                {
                    "last_affected": "12.1.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:retail_xstore_point_of_service",
            "extracted_events": [
                {
                    "last_affected": "16.0.6"
                },
                {
                    "last_affected": "17.0.4"
                },
                {
                    "last_affected": "18.0.3"
                },
                {
                    "last_affected": "19.0.2"
                },
                {
                    "last_affected": "20.0.1"
                }
            ]
        }
    ]
}
References

Affected packages