Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .7723 99.5 —
AFFECTED Product Versions Fixed xstream < 1.4.17 – —
TIMELINE Mar 30 Reserved by GitHub_M May 28 Published (CNA: GitHub_M) Oct 7 RESCORED — CVE-2021-29505 (x-stream xstream). CVSS 7.5 → 8.8 (NVD).
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
| Date | Event | Detail |
|---|---|---|
| March 30, 2021 | Reserved | Reserved by GitHub_M |
| May 28, 2021 | Published | Published (CNA: GitHub_M) |
| October 7, 2026 | RESCORED | RESCORED — CVE-2021-29505 (x-stream xstream). CVSS 7.5 → 8.8 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| x-stream | xstream | — | < 1.4.17 | — |
Authoritative record: CVE-2021-29505 at cve.org
Vendors: x-stream
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-29505 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
