CVE-2021-28099 — hollow
MEDIUMCVE-2021-28099 is a medium-severity (CVSS 4.4) Insufficient Random Values vulnerability in com.netflix.hollow:hollow. No vendor fix is recorded yet; mitigation options are listed below.
Insecure temporary file in Netflix OSS Hollow
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2021-28099 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
com.netflix.hollow:hollowReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
ID: NFLX-2021-001 Title: Local information disclosure in Hollow Release Date: 2021-03-23 Credit: Security Researcher @JLLeitschuh
Overview
Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.
Impact
An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.
Description
Since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Workarounds and Fixes
Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.netflix.hollow:hollow | all versions | No fix |
Affected Products
hollownetflixDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.netflix.hollow:hollow, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of com.netflix.hollow:hollow has shipped for CVE-2021-28099 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is CVE-2021-28099 in your dependencies?
Find it across Maven, including transitive dependencies.