Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
Priority LOW 31CWE-378Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 22 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.
Summary
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01799 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.1.59.Finalio.netty:netty-codec-http (Maven): 4.1.59.FinalRed Hat: 20 advisoriesRed Hat: 22 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | before 4.1.59.Final | 4.1.59.Final | Patch available | CNA |
| — | io.netty:netty-codec-http (Maven) | 4.0.0 to before 4.1.59.Final | 4.1.59.Final | Patch available | GHSA-5mcr-gq6c-3hq2 |
| — | org.jboss.netty:netty (Maven) | all versions | — | No fix listed | GHSA-5mcr-gq6c-3hq2 |
| — | io.netty:netty (Maven) | all versions | — | No fix listed | GHSA-5mcr-gq6c-3hq2 |
- netty Vendornetty Affected before 4.1.59.Final Fixed in 4.1.59.Final Patch available CNA
- io.netty:netty-codec-http (Maven) Vendor— Affected 4.0.0 to before 4.1.59.Final Fixed in 4.1.59.Final Patch available GHSA-5mcr-gq6c-3hq2
- org.jboss.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-5mcr-gq6c-3hq2
- io.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-5mcr-gq6c-3hq2
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* | before 4.1.59 | Vulnerable | netty |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | up to 1.13.7 | Vulnerable | quarkusio |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
- cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.59 Vulnerable ·netty
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.13.7 Vulnerable ·quarkusio
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* | 12.0.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* | before 20.3 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 20.3 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA netty (netty) Fixed in 4.1.59.Final
- Fix · GHSA-5mcr-gq6c-3hq2 io.netty:netty-codec-http (Maven) Fixed in 4.1.59.Final Advisory →
Red Hat 20 advisories
- RHSA-2022:5498 Released 2022-07-05 · Red Hat rating ModerateSatellite 6.11 Release
- Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
- Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
- RHSA-2022:1110 Released 2022-03-29 · Red Hat rating ModerateRed Hat Decision Manager 7.12.1 security update
- RHDM 7.12.1
- RHSA-2022:1108 Released 2022-03-29 · Red Hat rating ModerateRed Hat Process Automation Manager 7.12.1 security update
- RHPAM 7.12.1
Show 17 more Red Hat advisories
- RHSA-2022:0190 Released 2022-01-19 · Red Hat rating ModerateSatellite 6.10.2 Async Bug Fix Update
- Red Hat Satellite 6.10 satellite-6.10.2-1.el7sat, satellite-cli-6.10.2-1.el7sat, satellite-common-6.10.2-1.el7sat
- Red Hat Satellite Capsule 6.10 satellite-6.10.2-1.el7sat, satellite-capsule-6.10.2-1.el7sat, satellite-common-6.10.2-1.el7sat
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:3880 Released 2021-10-20 · Red Hat rating ModerateRed Hat build of Quarkus 2.2.3 release and security update
- Red Hat build of Quarkus 2.2.3
- RHSA-2021:3700 Released 2021-09-30 · Red Hat rating ModerateRed Hat AMQ Broker 7.9.0 release and security update
- Red Hat AMQ 7.9.0
- RHSA-2021:3225 Released 2021-08-19 · Red Hat rating ModerateRed Hat AMQ Streams 1.8.0 release and security update
- Red Hat AMQ Streams 1.8.0
- RHSA-2021:2755 Released 2021-07-15 · Red Hat rating ModerateEAP XP 2 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
- RHSA-2021:2689 Released 2021-07-12 · Red Hat rating ModerateRed Hat AMQ Broker 7.8.2 release and security update
- Red Hat AMQ 7.8.2
- RHSA-2021:2210 Released 2021-06-02 · Red Hat rating ModerateEAP XP 1 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP via EAP 7.3.x base
- RHSA-2021:2139 Released 2021-05-26 · Red Hat rating CriticalRed Hat Data Grid 8.2.0 security update
- Red Hat Data Grid 8.2.0
- RHSA-2021:2070 Released 2021-05-20 · Red Hat rating ModerateRed Hat Single Sign-On 7.4.7 security update
- Red Hat Single Sign-On 7.4.7
- RHSA-2021:2048 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 8
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el8eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el8eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el8eap +47
- RHSA-2021:2046 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 6
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el6eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el6eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el6eap +47
- RHSA-2021:2047 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el7eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el7eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el7eap +47
- RHSA-2021:2051 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2021:1511 Released 2021-05-06 · Red Hat rating ModerateAMQ Clients 2.9.1 release and security update
- Red Hat AMQ Clients 2 python-qpid-proton-0.33.0-6.el7_9, python-qpid-proton-docs-0.33.0-6.el7_9, python-qpid-proton-docs-0.33.0-8.el8 +19
- RHSA-2021:0943 Released 2021-03-31 · Red Hat rating ModerateRed Hat build of Eclipse Vert.x 4.0.3 security update
- Red Hat build of Eclipse Vert.x 4.0.3
- RHSA-2021:0986 Released 2021-03-25 · Red Hat rating LowAMQ Online 1.7.0 release and security update
- Red Hat AMQ Online 1.7.0 GA
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| RHDM 7.12.1 | Fixed | RHSA-2022:1110 |
| RHPAM 7.12.1 | Fixed | RHSA-2022:1108 |
| Red Hat AMQ 7.8.2 | Fixed | RHSA-2021:2689 |
| Red Hat AMQ 7.9.0 | Fixed | RHSA-2021:3700 |
| Red Hat AMQ Clients 2 | Fixed | RHSA-2021:1511 |
| Red Hat AMQ Online 1.7.0 GA | Fixed | RHSA-2021:0986 |
| Red Hat AMQ Streams 1.8.0 | Fixed | RHSA-2021:3225 |
| Red Hat Data Grid 8.2.0 | Fixed | RHSA-2021:2139 |
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | Fixed | RHSA-2021:2755 |
| Red Hat EAP-XP via EAP 7.3.x base | Fixed | RHSA-2021:2210 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2021:2048 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2021:2046 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2021:2047 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2021:2051 |
| Red Hat Satellite 6.10 | Fixed | RHSA-2022:0190 |
| Red Hat Satellite 6.11 for RHEL 7 | Fixed | RHSA-2022:5498 |
| Red Hat Satellite 6.11 for RHEL 8 | Fixed | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6.10 | Fixed | RHSA-2022:0190 |
| Red Hat Single Sign-On 7.4.7 | Fixed | RHSA-2021:2070 |
| Red Hat build of Eclipse Vert.x 4.0.3 | Fixed | RHSA-2021:0943 |
| Red Hat build of Quarkus 2.2.3 | Fixed | RHSA-2021:3880 |
Not affected: 4 products
- Red Hat Satellite 6.10
- Red Hat Satellite 6.11 for RHEL 7
- Red Hat Satellite 6.11 for RHEL 8
- Red Hat Satellite Capsule 6.10
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21290
- 2026-10-03 Alias added: GHSA-5mcr-gq6c-3hq2
- 2026-10-08 CISA SSVC decision points changed
References
Patch 4
Advisory 5
Other 62
- [kafka-jira] 20210301 [jira] [Created] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290
- [kafka-dev] 20210301 [jira] [Created] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210301 [jira] [Assigned] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210301 [GitHub] [kafka] dongjinleekr opened a new pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210301 [GitHub] [kafka] dongjinleekr commented on pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [kafka-dev] 20210302 [jira] [Resolved] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210302 [jira] [Resolved] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210302 [GitHub] [kafka] omkreddy closed pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [kafka-commits] 20210302 [kafka] branch 2.6 updated: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [kafka-commits] 20210302 [kafka] branch 2.7 updated: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [kafka-jira] 20210302 [GitHub] [kafka] dongjinleekr commented on pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290
- [zookeeper-issues] 20210311 [jira] [Created] (ZOOKEEPER-4242) Upgrade Netty library to > 4.1.59 due to security vulnerability
- [zookeeper-dev] 20210311 [jira] [Created] (ZOOKEEPER-4242) Upgrade Netty library to > 4.1.59 due to security vulnerability
- [tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2535) Netty 4.1.52 flagged as medium security violation
- [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295
- [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295
- [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290
- [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final
- [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290
- [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final
- [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295
- [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295
- [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295
- [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295
- [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295
- [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295
- [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295
- https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05%40%3Cdev.kafka.apache.org%3E
- [activemq-users] 20210715 Next ActiveMQ Artemis Release - CVE-2021-21290 vulnerability
- [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0
- https://github.com/netty/netty
- https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5@%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ra0fc2b4553dd7aaf75febb61052b7f1243ac3a180a71c01f29093013@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/ra503756ced78fdc2136bd33e87cb7553028645b261b1f5c6186a121e@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def81977438e27a3dc2bb@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rdba4f78ac55f803893a1a2265181595e79e3aa027e2e651dfba98c18@%3Cjira.kafka.apache.org%3E
- https://security.netapp.com/advisory/ntap-20220210-0011
- https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f@%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r0857b613604c696bf9743f0af047360baaded48b1c75cf6945a083c5@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r10308b625e49d4e9491d7e079606ca0df2f0a4d828f1ad1da64ba47b@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d6c8ec40f4e2e87bd4@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r326ec431f06eab7cb7113a7a338e59731b8d556d05258457f12bac1b@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r4efed2c501681cb2e8d629da16e48d9eac429624fd4c9a8c6b8e7020@%3Cdev.tinkerpop.apache.org%3E
- https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r5bf303d7c04da78f276765da08559fdc62420f1df539b277ca31f63b@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r5c701840aa2845191721e39821445e1e8c59711e71942b7796a6ec29@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r5e4a540089760c8ecc2c411309d74264f1dad634ad93ad583ca16214@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r71dbb66747ff537640bb91eb0b2b24edef21ac07728097016f58b01f@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r743149dcc8db1de473e6bff0b3ddf10140a7357bc2add75f7d1fbb12@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890@%3Cissues.bookkeeper.apache.org%3E
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2021-21290 · CVE Program
- CVE-2021-21290 · NVD
- FIRST EPSS
- GHSA-5mcr-gq6c-3hq2 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21290 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences