StackRadar

CVE-2021-28170

Medium

Advisory

Published 6 Oct 2021In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.021
81st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
85
deployed by those charts
Fix available
1 of 2
affected packages

Improper Input Validation in Jakarta Expression Language

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 85 images.

Affected packageAffected versionsFixed inImages
jakarta.elmaven3.0.2, 3.0.3, 3.0.3.jbossorg-2, 3.0.3.jbossorg-43.0.455
javax.elmaven3.0.0, 3.0.1-b08, 3.0.1-b11, 3.0.1-b12no fix listed35
OSV records
GHSA-v6w3-2prq-h95f

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
pagesgary-pages1.0.01 of 3See more

pages gary-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
jakarta.el@3.0.3
3.0.4

Open the chart page →

12,581
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
jakarta.el@3.0.3
3.0.4

Open the chart page →

17,702
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
jakarta.el@3.0.3
3.0.4

Open the chart page →

34,754
hivegradiant-bigdataVerified publisher0.1.62 of 5See more

hive gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
javax.el@3.0.0
no fix listed
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
javax.el@3.0.0
no fix listed

Open the chart page →

20,837
hive-metastoregradiant-bigdataVerified publisher0.1.31 of 2See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
javax.el@3.0.0
no fix listed

Open the chart page →

6,882
opentsdbgradiant-bigdataVerified publisher0.1.71 of 6See more

opentsdb gradiant-bigdata 0.1.7

1 of the 6 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
javax.el@3.0.1-b08
no fix listed

Open the chart page →

17,511
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
javax.el@3.0.0
no fix listed

Open the chart page →

6,362
hbasehbase0.1.71 of 4See more

hbase hbase 0.1.7

1 of the 4 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
javax.el@3.0.1-b08
no fix listed

Open the chart page →

10,540
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
skywalking-v1huangchengwu-helm-chart0.1.01 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.9.180530f0308a5
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,650
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
javax.el@3.0.1-b11
no fix listed

Open the chart page →

37,671
nexusjenkins-x0.1.371 of 1See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
jakarta.el@3.0.3
3.0.4

Open the chart page →

12,856
spring-boot-chartjhidalgo3-githubVerified publisher4.0.01 of 1See more

spring-boot-chart jhidalgo3-github 4.0.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
jhidalgo3/spring-echo-example:lateste08733191ea0
jakarta.el@3.0.3
3.0.4

Open the chart page →

1,703
kron-aapm-agentkron-aapm-agent1.1.01 of 1See more

kron-aapm-agent kron-aapm-agent 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.1.07feef7d2ab42
jakarta.el@3.0.3
3.0.4

Open the chart page →

8,884
tapm-componentkubebb5.7.12 of 3See more

tapm-component kubebb 5.7.1

2 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
refar/apm-api:v5.7.1241373fa2972
jakarta.el@3.0.3
3.0.4
refar/apm-operator-server:v5.7.1e5490f050f9f
jakarta.el@3.0.3
3.0.4

Open the chart page →

10,264
pageslatif-pages1.0.01 of 3See more

pages latif-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pageslavanya-pages1.0.01 of 3See more

pages lavanya-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagesliviu884422-pages1.0.01 of 3See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
kafka-connect-wrapperlsmhun0.1.01 of 1See more

kafka-connect-wrapper lsmhun 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
lsmaster/kafka-connect-wrapper:6.1.0-0.1061eb5fbfa00
jakarta.el@3.0.3
3.0.4

Open the chart page →

2,391
lavandaluiscajl0.0.1344 of 5See more

lavanda luiscajl 0.0.134

4 of the 5 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
jakarta.el@3.0.3
3.0.4
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
jakarta.el@3.0.3
3.0.4
lavandadelpatio/filebot:0.0.671f2ccec8c0d
jakarta.el@3.0.3
3.0.4
lavandadelpatio/tmdb:0.0.2f36af885e915
jakarta.el@3.0.3
3.0.4

Open the chart page →

18,248
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
javax.el@3.0.0
no fix listed

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
javax.el@3.0.0
no fix listed

Open the chart page →

10,603
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
datawolfncsaVerified publisher1.1.01 of 3See more

datawolf ncsa 1.1.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
ncsa/datawolf:4.7.0af6649d59150
javax.el@3.0.0
no fix listed

Open the chart page →

4,989
dependency-tracknovum-rgi-charts0.1.81 of 2See more

dependency-track novum-rgi-charts 0.1.8

1 of the 2 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
owasp/dependency-track:3.8.0efc65e702ee1
jakarta.el@3.0.2
3.0.4

Open the chart page →

3,633
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
javax.el@3.0.0
no fix listed

Open the chart page →

6,037
bpjstk-serviceopenshift1.0.04 of 6See more

bpjstk-service openshift 1.0.0

4 of the 6 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
andrianrf/bpjstk-service:latest46abe878d9d8
jakarta.el@3.0.3
3.0.4
andrianrf/bpjstk-simulator:latestb63fdb51d39d
jakarta.el@3.0.3
3.0.4
andrianrf/iso-client:latestba560086ce15
jakarta.el@3.0.3
3.0.4
andrianrf/iso-server:latest7da47f525c7d
jakarta.el@3.0.3
3.0.4

Open the chart page →

34,671
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
openwhisk/invoker:1.0.0f5831ec85525
javax.el@3.0.1-b11
no fix listed

Open the chart page →

36,215
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
javax.el@3.0.0
no fix listed

Open the chart page →

1,190
pagespages1.0.01 of 3See more

pages pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-10.1.01 of 1See more

pages pages-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:1.04d2eb25b9225
jakarta.el@3.0.3
3.0.4

Open the chart page →

10,392
pagespages101.0.01 of 3See more

pages pages10 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages1111.0.01 of 3See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages21.0.01 of 3See more

pages pages2 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-alexchmielu1.0.01 of 3See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-alps1.0.01 of 3See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-alstom1.0.01 of 3See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-ambala1.0.01 of 3See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-andromeda1.0.01 of 3See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespagesbadami1.0.01 of 3See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-blackburn1.0.01 of 3See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-botes1.0.01 of 3See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-brian1.0.01 of 3See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-buckll1.0.01 of 3See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190
pagespages-camden1.0.01 of 3See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-28170.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jakarta.el@3.0.3
3.0.4

Open the chart page →

20,190

Container images carrying it

85 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
jakarta.el@3.0.3
3.0.4
1
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
jakarta.el@3.0.3
3.0.4
1
lavandadelpatio/filebot:0.0.671f2ccec8c0d
jakarta.el@3.0.3
3.0.4
1
lavandadelpatio/tmdb:0.0.2f36af885e915
jakarta.el@3.0.3
3.0.4
1
library/storm:2.4.0bd5d420506d6
jakarta.el@3.0.2
javax.el@3.0.1-b12
3.0.4
no fix listed
1
lsmaster/kafka-connect-wrapper:6.1.0-0.1061eb5fbfa00
jakarta.el@3.0.3
3.0.4
1
magento/magento-cloud-docker-opensearch:2.5-1.4.059fb6f0f1461
javax.el@3.0.0
no fix listed
1
ncsa/datawolf:4.7.0af6649d59150
javax.el@3.0.0
no fix listed
1
opensearchproject/opensearch:2.12.0645d3d9390ad
javax.el@3.0.0
no fix listed
1
opensearchproject/opensearch:2.10.0c8f3ebd2a934
javax.el@3.0.0
no fix listed
1
openwhisk/invoker:1.0.0f5831ec85525
javax.el@3.0.1-b11
no fix listed
1
owasp/dependency-track:3.8.0efc65e702ee1
jakarta.el@3.0.2
3.0.4
1
platform9community/api-gateway:latest40a4970de568
jakarta.el@3.0.3
javax.el@3.0.1-b11
3.0.4
no fix listed
1
platform9community/customers-service:latest2089811e5cc6
jakarta.el@3.0.3
javax.el@3.0.1-b11
3.0.4
no fix listed
1
platform9community/vets-service:latestd1165c94dfb3
jakarta.el@3.0.3
javax.el@3.0.1-b11
3.0.4
no fix listed
1
platform9community/visits-service:latest8d11b50368c6
jakarta.el@3.0.3
javax.el@3.0.1-b11
3.0.4
no fix listed
1
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
javax.el@3.0.0
no fix listed
1
refar/apm-api:v5.7.1241373fa2972
jakarta.el@3.0.3
3.0.4
1
refar/apm-operator-server:v5.7.1e5490f050f9f
jakarta.el@3.0.3
3.0.4
1
remche/shinyproxy:2.6.18bcda8a04d3b
javax.el@3.0.1-b11
no fix listed
1
reportportal/service-jobs:5.7.2dc166c58485a
jakarta.el@3.0.3
3.0.4
1
robotshop/rs-shipping:latest89753ab48919
jakarta.el@3.0.3
3.0.4
1
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
javax.el@3.0.0
no fix listed
1
someblackmagic/smtp-fake-server:latest0d63ba37a560
jakarta.el@3.0.3
3.0.4
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
javax.el@3.0.1-b12
no fix listed
1
thelastpickle/cassandra-reaper:1.3.09c53996c457d
javax.el@3.0.0
no fix listed
1
thingsboard/tb-node:3.4.1645f43b688f7
javax.el@3.0.0
no fix listed
1
thingsboard/tb-node:3.6.0f40a542832c4
javax.el@3.0.0
no fix listed
1
trinodb/trino:45038c6f24ab1a4
javax.el@3.0.1-b08
no fix listed
1
trinodb/trino:405ee80ab5eeab2
javax.el@3.0.1-b12
no fix listed
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
javax.el@3.0.1-b08
no fix listed
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
jakarta.el@3.0.3
3.0.4
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
jakarta.el@3.0.3
3.0.4
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
jakarta.el@3.0.3.jbossorg-2
3.0.4
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
javax.el@3.0.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.