CVE-2021-21290

Medium

Advisory

Published 8 Feb 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.018; 77th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 151; of 17,781 indexed, latest versions
Container images: 162; deployed by those charts
Fix available: 1 of 2; affected packages

Local Information Disclosure Vulnerability in Netty on Unix-Like systems

Carried by container images the latest versions of 151 of 17,781 indexed charts deploy, on 162 images.

Affected package	Affected versions	Fixed in	Images
netty-codec-httpmaven	4.0.27.Final, 4.0.52.Final, 4.1.12.Final, 4.1.13.Final+21 more	4.1.59.Final	113
nettymaven	3.2.10.Final, 3.6.1.Final, 3.6.2.Final, 3.6.6.Final+6 more	no fix listed	66

OSV records: GHSA-5mcr-gq6c-3hq2

Charts affected

151 by stars

Chart

Latest

Affected images

Radar Score

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-21290.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	netty-codec-http@4.1.45.Final	4.1.59.Final

Open the chart page →

5,806

Container images carrying it

162 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/shenyu-bootstrap :2.5.1	1bd5756f6273	netty-codec-http@4.1.51.Final	4.1.59.Final	1
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	netty@3.10.5.Final netty-codec-http@4.1.42.Final	no fix listed 4.1.59.Final	1
apache/skywalking-ui :8.1.0	67d50e4deff4	netty-codec-http@4.0.27.Final	4.1.59.Final	1
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	netty-codec-http@4.1.49.Final	4.1.59.Final	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	netty-codec-http@4.1.49.Final	4.1.59.Final	1
arturisimo/planner :v1.0	fff9de644941	netty-codec-http@4.1.42.Final	4.1.59.Final	1
assistiot/authorization_svr :latest	db9361dad79b	netty@3.7.0.Final	no fix listed	1
assistiot/cybersecurity-monitoring_id-elk :latest	ba1d85ec3739	netty-codec-http@4.1.49.Final	4.1.59.Final	1
assistiot/cybersecurity-monitoring_ir-elk :latest	4228b7a8ef40	netty-codec-http@4.1.49.Final	4.1.59.Final	1
assistiot/sdn_controller :2.4.0	ea254b6d8a31	netty@3.10.5.Final netty-codec-http@4.1.35.Final	no fix listed 4.1.59.Final	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	netty-codec-http@4.1.33.Final	4.1.59.Final	1
atomix/atomix :3.1.12	7738ff4f5c63	netty-codec-http@4.1.27.Final	4.1.59.Final	1
bivas/presto :0.196	05545994f806	netty@3.10.6.Final	no fix listed	1
budibase/database :2.1.0	d90f656261c9	netty@3.2.10.Final	no fix listed	1
choerodon/event-store-service :0.8.0	3c94c97f6f69	netty@3.7.0.Final netty-codec-http@4.0.27.Final	no fix listed 4.1.59.Final	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	netty-codec-http@4.1.50.Final	4.1.59.Final	1
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	netty-codec-http@4.1.45.Final	4.1.59.Final	1
confluentinc/cp-kafka :5.0.1	c87b1c07fb53	netty@3.10.6.Final	no fix listed	1
confluentinc/cp-kafka-connect :6.1.0	4bc70a83ca6f	netty-codec-http@4.1.47.Final	4.1.59.Final	1
confluentinc/cp-kafka-rest :6.1.0	b0b7aa26254a	netty-codec-http@4.1.50.Final	4.1.59.Final	1
confluentinc/cp-ksqldb-server :6.1.0	ee403d5b9090	netty-codec-http@4.1.45.Final	4.1.59.Final	1
confluentinc/cp-schema-registry :6.1.0	b651d4b6185a	netty-codec-http@4.1.45.Final	4.1.59.Final	1
datappeal/hive-metastore :latest	e38c085a3567	netty@3.10.5.Final netty-codec-http@4.1.17.Final	no fix listed 4.1.59.Final	1
davidvmar/urjc-davidvmar-worker :1.0.1	0d221e834a21	netty-codec-http@4.1.42.Final	4.1.59.Final	1
dbanda/livy :0.8	0ca125e68e53	netty@3.9.9.Final netty-codec-http@4.1.17.Final	no fix listed 4.1.59.Final	1
dbanda/spark :2.4.6	d0e6367876ae	netty@3.10.5.Final netty-codec-http@4.1.17.Final	no fix listed 4.1.59.Final	1
deltaio/delta-sharing-server :0.2.0	8b75118187c5	netty@3.10.6.Final	no fix listed	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	netty@3.10.6.Final netty-codec-http@4.1.52.Final	no fix listed 4.1.59.Final	1
duck1123/dinsro :latest	9568c5961d5d	netty@3.10.6.Final	no fix listed	1
egdsandaru/apache-ranger-admin :1.0.0	681baa1926f4	netty@3.10.6.Final	no fix listed	1
fimperato/sparkvid-api :1.0.5-RELEASE	604012b77841	netty@3.9.9.Final	no fix listed	1
fjvela/urjc-fjvela-worker :1.0.1	70cebf67bd66	netty-codec-http@4.1.42.Final	4.1.59.Final	1
folioci/mod-marccat :latest	1b57d690d568	netty-codec-http@4.1.22.Final	4.1.59.Final	1
fonoster/routr :1.0.0-rc5	2ca65af17cbc	netty-codec-http@4.1.32.Final	4.1.59.Final	1
franrobles8/planner :v3.0	99985392d63c	netty-codec-http@4.1.42.Final	4.1.59.Final	1
gchq/accumulo :2.0.1	c460bb587d6d	netty@3.10.6.Final	no fix listed	1
geoservercloud/geoserver-cloud-gateway :1.0-RC2	ca58b74529cd	netty-codec-http@4.1.51.Final	4.1.59.Final	1
geoservercloud/geoserver-cloud-rest :1.0-RC2	5dc0c93a1710	netty-codec-http@4.1.51.Final	4.1.59.Final	1
geoservercloud/geoserver-cloud-wcs :1.0-RC2	47ae1bdb4bcc	netty-codec-http@4.1.51.Final	4.1.59.Final	1
geoservercloud/geoserver-cloud-webui :1.0-RC2	28c3e5a8c5a3	netty-codec-http@4.1.51.Final	4.1.59.Final	1
geoservercloud/geoserver-cloud-wfs :1.0-RC2	8c70ee06d5ab	netty-codec-http@4.1.51.Final	4.1.59.Final	1
geoservercloud/geoserver-cloud-wms :1.0-RC2	42775ba6a4da	netty-codec-http@4.1.51.Final	4.1.59.Final	1
gradiant/hdfs :3.2.2	e3bf364fe713	netty@3.10.6.Final netty-codec-http@4.1.17.Final	no fix listed 4.1.59.Final	1
graylog2/server :2.4.3-3	8ff28c66e6c1	netty@3.10.6.Final	no fix listed	1
gridgain/community :8.9.11	d32d182a0e6a	netty@3.7.0.Final	no fix listed	1
hazelcast/hazelcast-jet :4.5.3	a825ecbe9fda	netty-codec-http@4.1.51.Final	4.1.59.Final	1
huertaslopez/i.huertas.2021-v.martinp.2021-planner :2.0.0	e2c18bd65472	netty-codec-http@4.1.42.Final	4.1.59.Final	1
hugohg34/planner :0.0.2	171f61e8d7e2	netty-codec-http@4.1.42.Final	4.1.59.Final	1
ibmcom/bai-elasticsearch-dev :19.0.2	5441dba2fa00	netty-codec-http@4.1.32.Final	4.1.59.Final	1
ibmcom/bai-flink-dev :19.0.2	e31ff09e8aad	netty@3.6.2.Final	no fix listed	1