CVE-2021-21290

Medium

Advisory

Published 8 Feb 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.018; 77th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 151; of 17,781 indexed, latest versions
Container images: 162; deployed by those charts
Fix available: 1 of 2; affected packages

Local Information Disclosure Vulnerability in Netty on Unix-Like systems

Carried by container images the latest versions of 151 of 17,781 indexed charts deploy, on 162 images.

Affected package	Affected versions	Fixed in	Images
netty-codec-httpmaven	4.0.27.Final, 4.0.52.Final, 4.1.12.Final, 4.1.13.Final+21 more	4.1.59.Final	113
nettymaven	3.2.10.Final, 3.6.1.Final, 3.6.2.Final, 3.6.6.Final+6 more	no fix listed	66

OSV records: GHSA-5mcr-gq6c-3hq2

Charts affected

151 by stars

Chart

Latest

Affected images

Radar Score

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-21290.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	netty-codec-http@4.1.45.Final	4.1.59.Final

Open the chart page →

5,806

Container images carrying it

162 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gradiant/hdfs :2.7.7	3b28784ba41f	netty@3.6.2.Final	no fix listed	7
bde2020/hive :2.3.2-postgresql-metastore	620267768985	netty@3.6.2.Final	no fix listed	4
mastercloudapps/planner :v1.23	40a950b311b2	netty-codec-http@4.1.42.Final	4.1.59.Final	4
oscarsotosanchez/toposervice :v1.0	d4d020e9f272	netty-codec-http@4.1.54.Final	4.1.59.Final	4
apache/shenyu-admin :2.4.2	e8b7c4ddd069	netty-codec-http@4.1.38.Final	4.1.59.Final	3
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	netty-codec-http@4.1.43.Final	4.1.59.Final	3
codeurjc/planner :v1.0	800cf520c245	netty-codec-http@4.1.42.Final	4.1.59.Final	3
gchq/hdfs :3.3.3	5ec58edbb2db	netty@3.10.6.Final	no fix listed	3
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	netty-codec-http@4.1.45.Final	4.1.59.Final	2
apache/druid :37.0.0	0116fb802786	netty@3.10.6.Final	no fix listed	2
apachepulsar/pulsar-manager :v0.1.0	b341ef76a852	netty-codec-http@4.1.24.Final	4.1.59.Final	2
danisla/hadoop :2.9.0	255ba2dd739b	netty@3.6.2.Final	no fix listed	2
empathyco/elasticsearch :6.6.2-memlock	bcf4365ee7ec	netty-codec-http@4.1.32.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	netty-codec-http@4.1.51.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	netty-codec-http@4.1.51.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	netty-codec-http@4.1.51.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	netty-codec-http@4.1.51.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	netty-codec-http@4.1.51.Final	4.1.59.Final	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	netty-codec-http@4.1.51.Final	4.1.59.Final	2
gradiant/hive :2.3.2-postgresql-metastore	aae4f8a21f8b	netty@3.6.2.Final	no fix listed	2
gradiant/opentsdb :2.4.0	c33d53913869	netty@3.10.6.Final	no fix listed	2
gradiant/spark :2.4.4-python-alpine	97657d56e927	netty@3.9.9.Final	no fix listed	2
nacos/nacos-server :v2.1.0	dcf04549c6d7	netty-codec-http@4.1.42.Final	4.1.59.Final	2
opensearchproject/opensearch :1.1.0	967d7f57f72f	netty-codec-http@4.1.45.Final	4.1.59.Final	2
scorpiobroker/scorpio :RegistrySubscriptionManager_2.1.0	01e11d800459	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :AtContextServer_2.1.0	5073ceef2fa0	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :RegistryManager_2.1.0	a2cfcf0947fd	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :QueryManager_2.1.0	b742a53b2803	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :HistoryManager_2.1.0	b7fe27a06ff5	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :SubscriptionManager_2.1.0	e08036670d66	netty-codec-http@4.1.32.Final	4.1.59.Final	2
scorpiobroker/scorpio :EntityManager_2.1.0	f02e8a429a08	netty-codec-http@4.1.32.Final	4.1.59.Final	2
wurstmeister/zookeeper :latest	7a7fd44a7210	netty@3.10.6.Final	no fix listed	2
5200710/hadoop :3.2.3-java8	092d3088a5fb	netty@3.10.6.Final	no fix listed	1
5200710/hive :3.1.3-postgresql-metastore	e34ab066d2ed	netty@3.10.5.Final netty-codec-http@4.0.52.Final	no fix listed 4.1.59.Final	1
adagber/planner :v1.0	e5c1ed097752	netty-codec-http@4.1.42.Final	4.1.59.Final	1
amartinm82/planner :v2.0	1184353ff57b	netty-codec-http@4.1.42.Final	4.1.59.Final	1
amazon/opendistro-for-elasticsearch :1.4.0	6df71eb04639	netty-codec-http@4.1.38.Final	4.1.59.Final	1
apache/druid :29.0.1	0cef139b6bf1	netty@3.10.5.Final	no fix listed	1
apache/hadoop :3	af361b20bec0	netty@3.10.6.Final	no fix listed	1
apacheignite/ignite :2.7.0	d7deab68b8fa	netty@3.10.6.Final	no fix listed	1
apache/iotdb :0.11.2	8647309f95d1	netty-codec-http@4.1.22.Final	4.1.59.Final	1
apache/iotdb :0.13.3-node	afa47bf1692a	netty-codec-http@4.1.53.Final	4.1.59.Final	1
apache/nifi-registry :1.14.0	090b7f87ec7f	netty-codec-http@4.1.33.Final	4.1.59.Final	1
apache/nifi-registry :0.8.0	974efa2f21da	netty-codec-http@4.1.33.Final	4.1.59.Final	1
apachepinot/pinot :latest-jdk11	0018bb04ced7	netty@3.9.6.Final	no fix listed	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	netty@3.10.6.Final	no fix listed	1
apachepulsar/pulsar :2.6.1	4db6ff0b4045	netty@3.10.6.Final netty-codec-http@4.1.48.Final	no fix listed 4.1.59.Final	1
apachepulsar/pulsar :2.9.0	d056c89b7131	netty@3.10.6.Final netty-codec-http@4.1.51.Final	no fix listed 4.1.59.Final	1
apachepulsar/pulsar :2.8.2	d538416d5afe	netty@3.10.6.Final netty-codec-http@4.1.51.Final	no fix listed 4.1.59.Final	1
apache/shenyu-admin :2.5.1	e2be712fc4f4	netty-codec-http@4.1.38.Final	4.1.59.Final	1