Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-k2em-k61t-8be2
Vulnerability ID VCID-k2em-k61t-8be2
Aliases CVE-2021-39149
GHSA-3ccq-5vw3-2p6x
Summary
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-502 Deserialization of Untrusted Data
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39149.json
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2021-39149
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2021-39149
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3ccq-5vw3-2p6x
cvssv3.1 8.5 https://github.com/x-stream/xstream
generic_textual HIGH https://github.com/x-stream/xstream
cvssv3.1 8.5 https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x
cvssv3.1_qr HIGH https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x
generic_textual HIGH https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x
cvssv3.1 8.5 https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
cvssv3.1 8.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
cvssv3.1 8.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
cvssv3.1 8.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
cvssv3.1 8.5 https://nvd.nist.gov/vuln/detail/CVE-2021-39149
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-39149
cvssv3.1 8.5 https://security.netapp.com/advisory/ntap-20210923-0003
generic_textual HIGH https://security.netapp.com/advisory/ntap-20210923-0003
cvssv3.1 8.5 https://www.debian.org/security/2021/dsa-5004
generic_textual HIGH https://www.debian.org/security/2021/dsa-5004
cvssv3.1 8.5 https://www.oracle.com/security-alerts/cpuapr2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpuapr2022.html
cvssv3.1 8.5 https://www.oracle.com/security-alerts/cpujan2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujan2022.html
cvssv3.1 8.5 https://www.oracle.com/security-alerts/cpujul2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujul2022.html
cvssv3.1 8.5 https://x-stream.github.io/CVE-2021-39149.html
generic_textual HIGH https://x-stream.github.io/CVE-2021-39149.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39149.json
https://api.first.org/data/v1/epss?cve=CVE-2021-39149
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39139
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39140
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39141
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39144
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39145
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39147
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39148
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39149
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39150
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39151
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39152
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39153
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39154
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/x-stream/xstream
https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
https://nvd.nist.gov/vuln/detail/CVE-2021-39149
https://security.netapp.com/advisory/ntap-20210923-0003
https://x-stream.github.io/CVE-2021-39149.html
1997784 https://bugzilla.redhat.com/show_bug.cgi?id=1997784
998054 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998054
GHSA-3ccq-5vw3-2p6x https://github.com/advisories/GHSA-3ccq-5vw3-2p6x
RHSA-2021:3956 https://access.redhat.com/errata/RHSA-2021:3956
RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918
RHSA-2022:0296 https://access.redhat.com/errata/RHSA-2022:0296
RHSA-2022:0297 https://access.redhat.com/errata/RHSA-2022:0297
RHSA-2022:0520 https://access.redhat.com/errata/RHSA-2022:0520
USN-5946-1 https://usn.ubuntu.com/5946-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39149.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/x-stream/xstream
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-39149
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20210923-0003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://www.debian.org/security/2021/dsa-5004
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpujan2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpujul2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://x-stream.github.io/CVE-2021-39149.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.7066
EPSS Score 0.00625
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:08:14.165052+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 38.6.0