UBUNTU-CVE-2021-43859

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-43859

    UBUNTU-CVE-2021-43859

    Published: 1 Feb 2022Last Modified: 20 May 2026
    Upstream:
    CVE-2021-43859

    Summary:

    Details: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

    References: https://ubuntu.com/security/CVE-2021-43859, https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf, https://x-stream.github.io/CVE-2021-43859.html, https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846, https://www.cve.org/CVERecord?id=CVE-2021-43859

    Affected packages

    Package

    Name: libxstream-java

    Purl: pkg:deb/ubuntu/libxstream-java?arch=source&distro=esm-infra-legacy%2Ftrusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.4.4-1
    1.4.7-1
    1.4.7-1ubuntu0.1
    1.4.7-1ubuntu0.1+esm1
    1.4.7-1ubuntu0.1+esm2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-43859 | CVE-DB