Skip to content
Fencer Vulns
medium 5.3

CVE-2021-28170 json

Improper Input Validation in Jakarta Expression Language

published 2021-05-26 5 y ago modified 2026-06-17 4 mo ago also GHSA-v6w3-2prq-h95f , EUVD-2021-2257

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Patch / fix

  • maven com.sun.el:el-ri 3.0.4
  • maven org.glassfish:jakarta.el 3.0.4
  • quarkus quarkus 2.3.0
  • eap7-netty jboss enterprise application platform 7.4 4.1.63-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.1-2.GA_redhat_00003.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.9-2.SP1_redhat_00001.1.el8eap
  • eap7-velocity jboss enterprise application platform 7.4 2.3.0-1.redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.63-1.Final_redhat_00001.1.el8eap
  • eap7-jakarta-el jboss enterprise application platform 7.4, jboss enterprise application platform 7.3 3.0.3-2.redhat_00006.1.el8eap
  • eap7-wildfly-elytron jboss enterprise application platform 7.4 1.15.5-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly-modules jboss enterprise application platform 7.4 7.4.1-2.GA_redhat_00003.1.el8eap

red hat advisories RHSA-2025:9582RHSA-2021:3658RHSA-2021:3656RHSA-2021:3466RHSA-2021:3468RHSA-2021:3467

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-28170 updated cvss 7.5

jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

  • Red Hat build of Quarkus jakarta.el Red Hat Enterprise Linux 9 jakarta-el Red Hat Integration Camel K 1 jakarta.el Red Hat Integration Camel Quarkus 1 jakarta.el
    affected: no fix available
  • Red Hat JBoss Data Grid 7 jakarta.el
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jakarta.el Red Hat OpenShift Application Runtimes jakarta.el
    affected: no fix available
  • Red Hat EAP 7.3.9 release
    fixed: vendor fix RHSA-2021:3471
  • Red Hat build of Quarkus 2.2.5
    fixed: vendor fix RHSA-2022:0589
  • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:3516
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jakarta-el 3.0.3-2.redhat_00006.1.el8eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el8eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el8eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el8eap, +59 more
    fixed: vendor fix RHSA-2021:3468
show 10 more
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jakarta-el 3.0.3-2.redhat_00006.1.el6eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el6eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el6eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el6eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el6eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el6eap, +59 more
    fixed: vendor fix RHSA-2021:3466
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jakarta-el 3.0.3-2.redhat_00006.1.el7eap, eap7-wildfly 7.3.9-2.GA_redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el7eap, eap7-hibernate 5.3.20-4.SP2_redhat_00001.1.el7eap, eap7-narayana 5.9.12-1.Final_redhat_00001.1.el7eap, +61 more
    fixed: vendor fix RHSA-2021:3467
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jakarta-el 3.0.3-2.redhat_00006.1.el7eap
    fixed: vendor fix RHSA-2021:3656
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jakarta-el 3.0.3-2.redhat_00006.1.el8eap
    fixed: vendor fix RHSA-2021:3658
  • Red Hat JBoss Enterprise Application Platform jakarta.el 3.0.3.redhat-00006
    fixed: vendor fix RHSA-2021:3660
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.11-4.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-2.Final_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7, eap7-glassfish-el 3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-3.Final_redhat_00004.1.ep7.el7, eap7-netty-all 4.1.63-2.Final_redhat_00003.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:9582
  • Red Hat Single Sign-On 7.4.9
    fixed: vendor fix RHSA-2021:3534
  • Red Hat RHINT Camel-K 1.6.4
    fixed: vendor fix RHSA-2022:1029
  • Red Hat RHINT Camel-Q 2.2.1
    fixed: vendor fix RHSA-2022:1013
  • Red Hat Decision Manager 7 jakarta.el Red Hat Integration Service Registry jakarta.el Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-yasson 1.0.9-1.redhat_00001.1.el7eap, eap7-velocity 2.3.0-1.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el7eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el7eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el7eap, eap7-netty 4.1.63-1.Final_redhat_00001.1.el7eap, +52 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-yasson 1.0.9-1.redhat_00001.1.el8eap, eap7-velocity 2.3.0-1.redhat_00001.1.el8eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el8eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el8eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el8eap, eap7-netty 4.1.63-1.Final_redhat_00001.1.el8eap, +50 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1442 more Red Hat Process Automation 7 jakarta.el
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/eclipse-ee4j/el-ri/issues/155 referenced PoC, tagged "exploit" by a source, unverified
  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven com.sun.el:el-ri
<3.0.4
3.0.4
maven org.glassfish:jakarta.el
<3.0.4
3.0.4
maven org.glassfish:javax.el
<=3.0.1-b12
 no fix listed

Affected products

  • The Eclipse Foundation Jakarta Expression Language Implementation

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.