Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H L N C H H H 8.5 .9812 99.9 YES
AFFECTED Product Versions Fixed xstream < 1.4.18 – —
TIMELINE Aug 16 Reserved by GitHub_M Aug 23 Published (CNA: GitHub_M) Mar 10 Added to CISA KEV, remediation due 2023-03-31
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
| Date | Event | Detail |
|---|---|---|
| August 16, 2021 | Reserved | Reserved by GitHub_M |
| August 23, 2021 | Published | Published (CNA: GitHub_M) |
| March 10, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-03-31 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| x-stream | xstream | — | < 1.4.18 | — |
Authoritative record: CVE-2021-39144 at cve.org
Vendors: x-stream
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-39144 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
