CVE-2021-21290

Medium

Advisory

Published 8 Feb 2021In the index since 6 Sept 2026

Local Information Disclosure Vulnerability in Netty on Unix-Like systems

Carried by container images the latest versions of 151 of 17,781 indexed charts deploy, on 162 images.

Affected package	Affected versions	Fixed in	Images
netty-codec-httpmaven	4.0.27.Final, 4.0.52.Final, 4.1.12.Final, 4.1.13.Final+21 more	4.1.59.Final	113
nettymaven	3.2.10.Final, 3.6.1.Final, 3.6.2.Final, 3.6.6.Final+6 more	no fix listed	66

151 by stars

Chart

Latest

Affected images

Radar Score

1 of the 3 container images this version deploys carry CVE-2021-21290.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	netty-codec-http@4.1.45.Final	4.1.59.Final

5,806

162 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
xetusoss/archiva :v2.2.5	88f25242b9ee	netty@3.6.6.Final	no fix listed	1
zammad/zammad-docker-compose :zammad-elasticsearch-4.1.0-31	8274d75a51fc	netty-codec-http@4.1.49.Final	4.1.59.Final	1
zbalogh/reservation-api-server :1.0.9	7c247e399a1f	netty-codec-http@4.1.45.Final	4.1.59.Final	1
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	netty-codec-http@4.1.45.Final	4.1.59.Final	1
ghcr.io/fleeksoft/hbase/hdfs :3.3.3.2	ac62269785ac	netty@3.10.6.Final	no fix listed	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	netty@3.10.6.Final	no fix listed	1
ghcr.io/kvaps/linstor-controller :v1.14.0	00ce11c31087	netty-codec-http@4.1.51.Final	4.1.59.Final	1
ghcr.io/kvaps/linstor-satellite :v1.14.0	a573fb9bc809	netty-codec-http@4.1.51.Final	4.1.59.Final	1
ghcr.io/melodyyangaws/hive-metastore :3.0.0	e949b0f733f0	netty@3.10.6.Final	no fix listed	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	netty@3.10.6.Final	no fix listed	1
ghcr.io/wbstack/queryservice :0.3.6_0.6	b83b5b81d4b6	netty@3.10.6.Final	no fix listed	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	netty@3.10.6.Final	no fix listed	1