CVE-2021-28170
MediumAdvisory
Published 6 Oct 2021In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.021
- 81st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 152
- of 17,787 indexed, latest versions
- Container images
- 85
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Improper Input Validation in Jakarta Expression Language
Carried by container images the latest versions of 152 of 17,787 indexed charts deploy, on 85 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jakarta.elmaven | 3.0.2, 3.0.3, 3.0.3.jbossorg-2, 3.0.3.jbossorg-4 | 3.0.4 | 55 |
| javax.elmaven | 3.0.0, 3.0.1-b08, 3.0.1-b11, 3.0.1-b12 | no fix listed | 35 |
- OSV records
- GHSA-v6w3-2prq-h95f
Charts affected
152 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| webhookie-allwebhookie | 0.1.2 | 1 of 3See more | 28,699 |
| opendistro-eswitcom-gmbh | 1.13.3 | 1 of 3See more | 5,807 |
Container images carrying it
85 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| lavandadelpatio/ | 94e225a5a6f8 | jakarta.el | 3.0.4 | 1 |
| lavandadelpatio/ | 92de3c3426d2 | jakarta.el | 3.0.4 | 1 |
| lavandadelpatio/ | 71f2ccec8c0d | jakarta.el | 3.0.4 | 1 |
| lavandadelpatio/ | f36af885e915 | jakarta.el | 3.0.4 | 1 |
| library/ | bd5d420506d6 | jakarta.el javax.el | 3.0.4 no fix listed | 1 |
| lsmaster/ | 061eb5fbfa00 | jakarta.el | 3.0.4 | 1 |
| magento/ | 59fb6f0f1461 | javax.el | no fix listed | 1 |
| ncsa/ | af6649d59150 | javax.el | no fix listed | 1 |
| opensearchproject/ | 645d3d9390ad | javax.el | no fix listed | 1 |
| opensearchproject/ | c8f3ebd2a934 | javax.el | no fix listed | 1 |
| openwhisk/ | f5831ec85525 | javax.el | no fix listed | 1 |
| owasp/ | efc65e702ee1 | jakarta.el | 3.0.4 | 1 |
| platform9community/ | 40a4970de568 | jakarta.el javax.el | 3.0.4 no fix listed | 1 |
| platform9community/ | 2089811e5cc6 | jakarta.el javax.el | 3.0.4 no fix listed | 1 |
| platform9community/ | d1165c94dfb3 | jakarta.el javax.el | 3.0.4 no fix listed | 1 |
| platform9community/ | 8d11b50368c6 | jakarta.el javax.el | 3.0.4 no fix listed | 1 |
| polyakov/ | dbcef69146b8 | javax.el | no fix listed | 1 |
| refar/ | 241373fa2972 | jakarta.el | 3.0.4 | 1 |
| refar/ | e5490f050f9f | jakarta.el | 3.0.4 | 1 |
| remche/ | 8bcda8a04d3b | javax.el | no fix listed | 1 |
| reportportal/ | dc166c58485a | jakarta.el | 3.0.4 | 1 |
| robotshop/ | 89753ab48919 | jakarta.el | 3.0.4 | 1 |
| slamdev/ | b4b029c9b15f | javax.el | no fix listed | 1 |
| someblackmagic/ | 0d63ba37a560 | jakarta.el | 3.0.4 | 1 |
| svtechnmaa/ | 6e368ace0977 | javax.el | no fix listed | 1 |
| thelastpickle/ | 9c53996c457d | javax.el | no fix listed | 1 |
| thingsboard/ | 645f43b688f7 | javax.el | no fix listed | 1 |
| thingsboard/ | f40a542832c4 | javax.el | no fix listed | 1 |
| trinodb/ | 38c6f24ab1a4 | javax.el | no fix listed | 1 |
| trinodb/ | ee80ab5eeab2 | javax.el | no fix listed | 1 |
| ghcr.io/ | c144bdd688d7 | javax.el | no fix listed | 1 |
| ghcr.io/ | 8caf5289fe73 | jakarta.el | 3.0.4 | 1 |
| ghcr.io/ | ef3670f7e0a8 | jakarta.el | 3.0.4 | 1 |
| quay.io/ | 3029dc0f1d38 | jakarta.el | 3.0.4 | 1 |
| quay.io/ | 98c26e1b8f70 | javax.el | no fix listed | 1 |