Skip to content
OpenAdvisories
Medium · 5.3 CVE-2021-28170 EUVD-2021-2257GHSA-v6w3-2prq-h95f

Improper Input Validation in Jakarta Expression Language

Published May 26, 2021 · Updated Aug 3, 2024 · Assigned by eclipse

Vendor: The Eclipse Foundation Product: Jakarta Expression Language Implementation Package: com.sun.el:el-ri Package: jakarta-el-api Package: jakarta-el-api Package: org.glassfish:jakarta.el Package: org.glassfish:javax.el Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Affected products

VendorProductAffectedFixed
The Eclipse Foundation Jakarta Expression Language Implementation unspecified – ≤ 3.0.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jakarta-el-api No fix yet —
Debian 13 jakarta-el-api No fix yet —
Debian 12 jakarta-el-api No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jakarta-el-api No fix yet —
Ubuntu 26.04 LTS jakarta-el-api No fix yet —
Ubuntu 25.10 jakarta-el-api No fix yet —
Ubuntu 24.04 LTS jakarta-el-api No fix yet —
Ubuntu 22.04 LTS jakarta-el-api No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-glassfish-el +1 3.0.1-4.b08_redhat_00005.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +5 5.1.17-3.Final_redhat_00004.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-ejb-client 4.0.12-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-2.Final_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.11-4.GA_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.14-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-http-client +4 1.0.21-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-naming-client 1.0.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl-linux 1.0.12-6.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat JBoss EAP 7 eap7-apache-commons-io 2.10.0-1.redhat_00001.1.el6eap RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468
Red Hat JBoss EAP 7 eap7-hal-console 3.2.16-1.Final_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.20-4.SP2_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.35-1.Final_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-jakarta-el 3.0.3-2.redhat_00006.1.el6eap RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468
Red Hat JBoss EAP 7 eap7-jberet +1 1.3.9-1.Final_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.23-2.SP1_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-9.Final_redhat_00010.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.12-1.Final_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-netty +1 4.1.63-1.Final_redhat_00001.1.el7eap RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-9.Final_redhat_00008.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-undertow 2.0.39-1.SP2_redhat_00001.1.el6eap RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468
Red Hat JBoss EAP 7 eap7-velocity +1 2.3.0-1.redhat_00001.1.el7eap RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.9-2.GA_redhat_00002.1.el6eap RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.5-1.Final_redhat_00001.1.el7eap RHSA-2021:3658, RHSA-2021:3656
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.29-1.Final_redhat_00002.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.9-2.GA_redhat_00002.1.el7eap RHSA-2021:3656, RHSA-2021:3467
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.14-2.Final_redhat_00001.1.el6eap RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.sun.el:el-ri < 3.0.4 3.0.4 GHSA-v6w3-2prq-h95f
Maven org.glassfish:jakarta.el < 3.0.4 3.0.4 GHSA-v6w3-2prq-h95f
Maven org.glassfish:javax.el <= 3.0.1-b12 — GHSA-v6w3-2prq-h95f

Advisories 12

References