CVE-2021-21290: Local Information Disclosure Vulnerability in Netty on Unix-Like systems
Summary
CVE-2021-21290: Local Information Disclosure Vulnerability in Netty on Unix-Like systems. Affects io.netty:netty-codec-http versions >= 4.0.0, < 4.1.59.Final. Fixed in 4.1.59.Final. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2021-21290 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Netty is a popular open-source networking framework for building high-performance, scalable applications on the Java platform. It provides an asynchronous event-driven architecture that allows developers to easily create network servers and clients. Netty includes various modules, including the netty-codec-http module, which provides support for handling HTTP requests and responses. However, a vulnerability has been discovered in the netty-codec-http module that can lead to local information disclosure on Unix-like systems.
Vulnerability Detail
The vulnerability arises when netty's multipart decoders are used to handle file uploads and temporary storing of uploads on the disk is enabled. On Unix-like systems, the temporary directory is shared between all users, and if sensitive information is written to this directory without explicitly setting the file/directory permissions, it can be accessed by other local users. The AbstractDiskHttpData class in netty's codec-http module is vulnerable to this issue. This vulnerability can result in the disclosure of sensitive information to unauthorized users.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.59.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the netty dependency is not feasible, a workaround is to specify a custom java.io.tmpdir when starting the JVM or use the DefaultHttpDataFactory.setBaseDir(...) method to set the directory to a location that is only readable by the current user. This can help mitigate the risk of local information disclosure.
Conclusion
The local information disclosure vulnerability in the netty-codec-http module can lead to the exposure of sensitive information on Unix-like systems. It is crucial to update the netty dependency to version 4.1.59.Final or later to mitigate this vulnerability. Additionally, specifying a secure temporary directory or using the DefaultHttpDataFactory.setBaseDir(...) method can further enhance the security of file uploads. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-codec-http →
FAQ
The vulnerability can lead to local information disclosure on Unix-like systems, where sensitive information written to the shared temporary directory can be accessed by other local users.
Versions of netty prior to 4.1.59.Final are affected by this vulnerability.
No, this vulnerability only affects Unix-like systems. Windows and MacOS systems are not impacted.
To fix the vulnerability, update your netty dependency to version 4.1.59.Final or later. Additionally, consider specifying a custom java.io.tmpdir or using the DefaultHttpDataFactory.setBaseDir(...) method to set a secure directory for temporary file storage.
Yes, if updating the netty dependency is not feasible, you can specify a custom java.io.tmpdir or use the DefaultHttpDataFactory.setBaseDir(...) method to set a secure directory for temporary file storage.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-http.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
