[java-sig-commits] [Bug 1997794] New: CVE-2021-39152 xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host [fedora-all]