Vulnerabilities > CVE-2021-39140 - Infinite Loop vulnerability in multiple products

047910
CVSS 6.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Vulnerable Configurations

Part Description Count
Application
Xstream_Project
39
Application
Netapp
2
Application
Oracle
27
OS
Debian
3
OS
Fedoraproject
3