Skip to main content
MEDIUM

CVE-2021-21290

CVSS v3

5.5

MEDIUM

EPSS Score

1.8 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for netty.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • io.netty:nettyMavenall versions · no fixed version listedand 1 other package
  • io.netty:netty-codec-httpMavenfrom 4.0.0 · fixed in 4.1.59.Final

Vendor advisories

  • CVE-2021-21290 Red Hat Product Security410 products fixed · 14 known affected

    netty: Information disclosure via the local system temporary directory

    netty as a component of Red Hat JBoss A-MQ 6 · netty as a component of Red Hat JBoss Data Grid 7 · netty as a component of Red Hat JBoss Enterprise Application Platform 5

  • RHSA-2022:5498 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Satellite 6.11 Release

  • RHSA-2022:1110 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Decision Manager 7.12.1 security update

  • RHSA-2022:1108 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update

  • RHSA-2022:0190 Red Hat Product Security7 products fixed

    Red Hat Security Advisory: Satellite 6.10.2 Async Bug Fix Update

  • RHSA-2021:5134 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update

15 more advisories

Full record on NVD

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

Technical details

Published
2021-02-08

Frequently asked questions

What is CVE-2021-21290?

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

Is CVE-2021-21290 actively exploited?

Active exploitation of CVE-2021-21290 has not been confirmed. Its EPSS score was 1.8% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-21290?

CVE-2021-21290 has a CVSS v3 base score of 5.5 (MEDIUM severity).

Running netty? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database