CVE-2021-21290 Netty
| Affected software | Netty |
|---|---|
| Severity | 6.2 Medium CVSS 3.1 3 scores |
| Fixed in | 4.1.59.Final |
| Weakness | CWE-378 |
| Published | 8 Feb 2021 |
| Updated | 8 Oct 2026 |
Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
CWE-379CWE-668
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 5 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 1.8% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2021-21290
Upgrade Netty to 4.1.59.Final or later. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
6.2 MEDIUM
v3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3 metrics
CVSS
6.2 MEDIUM v3.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
security-advisories@github.com | Secondary | published |
| CVSS 3.1 | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | |
| CVSS 2.0 | 1.9 | none | AV:L/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Communications Applications / Modeling (Netty) (7.4.2) Oracle Hospitality Applications / Spa and Leisure (Netty) (8.13, 8.14) Oracle PeopleSoft / Elastic Search (Netty) (8.57, 8.58, 8.59) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Modeling (Netty) | 7.4.2 | 7.4.2 |
| Oracle Hospitality Applications | Spa and Leisure (Netty) | 8.13, 8.14 | 8.13 · 8.14 |
| Oracle PeopleSoft | Elastic Search (Netty) | 8.57, 8.58, 8.59 | 8.57 · 8.58 · 8.59 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
io.netty:netty-codec-http |
4.0.0 | 4.1.59.Final |
unbounded |
org.jboss.netty:netty |
0 | none | unbounded |
io.netty:netty |
0 | none | unbounded |
Products and versions
16 products, 23 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 · 10.0 |
| osv | io.netty | netty | generic | any version |
| osv | io.netty | netty-codec-http | generic | ≥ 4.0.0 and ＜ 4.1.59 |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | cloud secure agent | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | netty | netty | generic | ＜ 4.1.59 |
| nvd | oracle | banking corporate lending process management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | banking credit facilities process management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | banking trade finance process management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | communications brm - elastic charging engine | generic | 12.0.0.3 |
| nvd | oracle | communications design studio | generic | 7.4.2 |
| nvd | oracle | communications messaging server | generic | 8.1 |
| nvd | oracle | nosql database | generic | ＜ 20.3 |
| osv | org.jboss.netty | netty | generic | any version |
| nvd | quarkus | quarkus | generic | ≤ 1.13.7 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** ELASTIC SEARCH (NETTY), MODELING (NETTY), SPA AND LEISURE (NETTY) **Products:** ORACLE PEOPLESOFT, ORACLE HOSPITALITY SUITE8, ORACLE COMMUNICATIONS DESIGN STUDIO, PEOPLESOFT ENTERPRISE PEOPLETOOLS, ORACLE HOSPITALITY APPLICATIONS, ORACLE COMMUNICATIONS APPLICATIONS
References
Timeline
Timeline
| Published | 2021-02-08 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |