GCVE - cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Jmeter (`afdc1bd6-3a3d-5979-9ece-c88f64413625`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/jmeter`	purl2cpe	2026-06-01 10:14:28.914795
`pkg:deb/debian/jakarta-jmeter`	purl2cpe	2026-06-01 10:14:28.914802
`pkg:deb/debiana/jakarta-jmeter`	purl2cpe	2026-06-01 10:14:28.914799
`pkg:deb/ubuntu/jakarta-jmeter`	purl2cpe	2026-06-01 10:14:28.914805
`pkg:github/apache/jmeter`	purl2cpe	2026-06-01 10:14:28.914807
`pkg:maven/org.apache.jmeter/ApacheJMeter`	purl2cpe	2026-06-01 10:14:28.914813
`pkg:maven/org.apache.jmeter/apachejketer`	purl2cpe	2026-06-01 10:14:28.914810

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21351`	vulnerable	2026-06-08 05:29:11.729537	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.4) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:15.000Z Updated: 2024-08-03T18:09:15.774Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c https://x-stream.github.io/CVE-2021-21351.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21350`	vulnerable	2026-06-08 05:29:11.727880	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:20.000Z Updated: 2024-08-03T18:09:15.914Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq https://x-stream.github.io/CVE-2021-21350.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21349`	vulnerable	2026-06-08 05:29:11.726144	A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:24.000Z Updated: 2024-08-03T18:09:15.735Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv https://x-stream.github.io/CVE-2021-21349.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21348`	vulnerable	2026-06-08 05:29:11.714309	XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) MEDIUM (5.3) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:45:29.000Z Updated: 2024-08-03T18:09:15.691Z Open on db.gcve.eu Reference links https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq https://x-stream.github.io/CVE-2021-21348.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21347`	vulnerable	2026-06-08 05:29:11.712463	XStream is vulnerable to an Arbitrary Code Execution attack MEDIUM (6.1) XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Published: 2021-03-22T23:40:13.000Z Updated: 2024-08-03T18:09:15.686Z Open on db.gcve.eu Reference links https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f https://x-stream.github.io/security.html#workaround http://x-stream.github.io/changes.html#1.4.16 https://x-stream.github.io/CVE-2021-21347.html https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21346`	vulnerable	2026-06-08 05:29:11.702936	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21345`	vulnerable	2026-06-08 05:29:11.695944	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21344`	vulnerable	2026-06-08 05:29:11.689317	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21343`	vulnerable	2026-06-08 05:29:11.678467	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21342`	vulnerable	2026-06-08 05:29:11.676921	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21341`	vulnerable	2026-06-08 05:29:11.669188	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.