Read the docs
TI-2021-09399 Aliases CVE-2021-28170GHSA-v6w3-2prq-h95f

Improper input validation in Eclipse Foundation Jakarta Expression Language Implementation

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 14 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-917.

Summary

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Why it matters now

EPSS 0.02132 82nd percentileScored 2026-11-08
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial com.sun.el:el-ri (Maven): 3.0.4org.glassfish:jakarta.el (Maven): 3.0.4Red Hat: 14 advisoriesRed Hat: 14 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationJakarta Expression Language Implementationup to 3.0.3—No fix listedCNA
—com.sun.el:el-ri (Maven)before 3.0.43.0.4Patch availableGHSA-v6w3-2prq-h95f
—org.glassfish:jakarta.el (Maven)before 3.0.43.0.4Patch availableGHSA-v6w3-2prq-h95f
—org.glassfish:javax.el (Maven)up to 3.0.1-b12—No fix listedGHSA-v6w3-2prq-h95f
  • Jakarta Expression Language Implementation VendorEclipse Foundation Affected up to 3.0.3 Fixed in — No fix listed CNA
  • com.sun.el:el-ri (Maven) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-v6w3-2prq-h95f
  • org.glassfish:jakarta.el (Maven) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-v6w3-2prq-h95f
  • org.glassfish:javax.el (Maven) Vendor— Affected up to 3.0.1-b12 Fixed in — No fix listed GHSA-v6w3-2prq-h95f

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jakarta_expression_language:*:*:*:*:*:*:*:*up to 3.0.3VulnerableEclipse Foundation
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.3.0Vulnerablequarkusio
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:eclipse:jakarta_expression_language:*:*:*:*:*:*:*:* Versions up to 3.0.3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.3.0 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-v6w3-2prq-h95f com.sun.el:el-ri (Maven) Fixed in 3.0.4 Advisory →
  • Fix · GHSA-v6w3-2prq-h95f org.glassfish:jakarta.el (Maven) Fixed in 3.0.4 Advisory →

Red Hat 14 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2022:1029 Released 2022-03-23 · Red Hat rating Important
    Red Hat Integration Camel-K 1.6.4 release and security update
    • RHINT Camel-K 1.6.4
  • RHSA-2022:1013 Released 2022-03-22 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update
    • RHINT Camel-Q 2.2.1
Show 11 more Red Hat advisories
  • RHSA-2022:0589 Released 2022-02-21 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.5 release and security update
    • Red Hat build of Quarkus 2.2.5
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:3534 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update
    • Red Hat Single Sign-On 7.4.9
  • RHSA-2021:3516 Released 2021-09-13 · Red Hat rating Important
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:3468 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el8eap +47
  • RHSA-2021:3467 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap +47
  • RHSA-2021:3466 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap +47
  • RHSA-2021:3471 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update
    • EAP 7.3.9 release

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
EAP 7.3.9 releaseFixed RHSA-2021:3471
RHINT Camel-K 1.6.4Fixed RHSA-2022:1029
RHINT Camel-Q 2.2.1Fixed RHSA-2022:1013
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:3516
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:3468
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:3466
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:3467
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3660
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat Single Sign-On 7.4.9Fixed RHSA-2021:3534
Red Hat build of Quarkus 2.2.5Fixed RHSA-2022:0589
Not affected: 6 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28170
  2. 2026-10-03 Alias added: GHSA-v6w3-2prq-h95f

References

Exploit 2

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences