How severe is CVE-2021-28168?

CVE-2021-28168 has a CVSS score of 5.5/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2021-28168?

CVE-2021-28168 affects the following packages: org.glassfish.jersey.core:jersey-common (Maven), org.glassfish.jersey.core:jersey-common (Maven). Ecosystems affected: Maven.

How do I fix CVE-2021-28168?

Update org.glassfish.jersey.core:jersey-common to 2.34 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-28168 is resolved across your whole dependency graph.

How do I detect CVE-2021-28168 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.glassfish.jersey.core:jersey-common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2021-28168 if there is no patch (or I can't update yet)?

Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Is CVE-2021-28168 actively exploited in the wild?

Yes. There are 2 known exploit references for CVE-2021-28168, including 2 in-the-wild exploitations observed on GitHub and other sources. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2021-28168?

CVE-2021-28168 has an EPSS (Exploit Prediction Scoring System) score of 0.9%, placing it in the 58th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2021-28168?

CVE-2021-28168 is classified as CWE-378 (CWE-378), CWE-379 (CWE-379), CWE-668 (CWE-668). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2021-28168 published, and has it been updated?

CVE-2021-28168 was published on April 22, 2021 and was last updated on October 20, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

MEDIUM severity

CVE-2021-28168 — jersey-common

MEDIUMFix: eclipse-ee4j/jersey#4712

CVE-2021-28168 is a medium-severity (CVSS 5.5) CWE-378 vulnerability in org.glassfish.jersey.core:jersey-common. 2 public exploit references exist, so weaponization risk is real. A fix is available for org.glassfish.jersey.core:jersey-common — see the affected versions and patch details below.

Local information disclosure via system temporary directory

Also known asGHSA-c43q-5hpj-4crv

Published

Apr 22, 2021

Updated

Oct 20, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

2 known

Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

0.9%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs58th percentile — riskier than 58% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-28168 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,308 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected

☕org.glassfish.jersey.core:jersey-common☕org.glassfish.jersey.core:jersey-common

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Eclipse Jersey 2.28 - 2.33 and Eclipse Jersey 3.0.0 - 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Workaround

This issue can be mitigated by manually setting the java.io.tmpdir system property when launching the JVM.

Patches

Jersey 2.34 and 3.0.2 forward sets the correct permissions on the temporary file created by Jersey.

References

Similar Vulnerabilities

Similar, but not the same:

JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp
Google Guava - https://github.com/google/guava/issues/4011
Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824
Eclipse Jetty - https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6

Original Disclosure:

Hello Jersey Security Team,

Utilizing a custom CodeQL query written as a part of the GitHub Security Lab Bug Bounty program, I've unearthed a local temporary file information disclosure vulnerability.

You can see the custom CodeQL query utilized here: https://lgtm.com/query/8831016213790320486/

This particular vulnerability exists because on unix-like systems (not including modern versions of MacOS) the system temporary directory is shared between all users. As such, failure to correctly set file permissions and/or verify exclusive creation of directories can lead to either local information disclosure, or local file hijacking by another user.

This vulnerability impacts the following locations in this project's source:

https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/core-common/src/main/java/org/glassfish/jersey/message/internal/FileProvider.java#L64-L73

https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/media/multipart/src/main/java/org/glassfish/jersey/media/multipart/internal/FormDataParamValueParamProvider.java#L202-L208

This vulnerability exists because of the vulnerability in the Utils.createTempFile:

https://github.com/eclipse-ee4j/jersey/blob/01c6a32a2064aeff2caa8133472e33affeb8a29a/core-common/src/main/java/org/glassfish/jersey/message/internal/Utils.java#L42-L53

This is because File.createTempFile creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system.

If there is sensitive information written to these files, it is disclosed to other local users on this system.

The fix for this vulnerability is to use the Files API (instead of the File API) to create temporary files/directories as this new API correctly sets the posix file permissions.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.glassfish.jersey.core:jersey-common`	≥ 2.28&&< 2.34	2.34`org.glassfish.jersey.core:jersey-common:2.34`
☕Maven	`org.glassfish.jersey.core:jersey-common`	≥ 3.0.0&&< 3.0.2	3.0.2`org.glassfish.jersey.core:jersey-common:3.0.2`

Affected Products

3 products · 4 configurations

Application

jerseyeclipse

≥ 3.0.0 && < 3.0.2

range

Application

communications cloud native core policyoracle

1 version

1.15.0

Application

communications cloud native core unified data repositoryoracle

1 version

1.15.0

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a…

lists.apache.orgNVDJun 2022

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a…

lists.apache.orgNVDJun 2022

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.glassfish.jersey.core:jersey-common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.glassfish.jersey.core:jersey-common to 2.34 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-28168 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

Product	Fixed in	Advisory
Red Hat AMQ Streams 1.8.0	`jersey-common`	RHSA-2021:3225
RHINT Camel-K 1.6.4	`jersey-common`	RHSA-2022:1029
RHINT Camel-Q 2.2.1	see advisory	RHSA-2022:1013

Frequently Asked Questions

## Impact Eclipse Jersey 2.28 - 2.33 and Eclipse Jersey 3.0.0 - 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the `File.createTempFile` which creates a file inside of the system temporary directory with the permissions: `-rw-r--r--`. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. ## Workaround This issue can be mitigated by manually setting the `java.io.tmpdir` system property when launching the JVM. ## Patches Jer

O3 Security · Impact-Aware SCA

Is CVE-2021-28168 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works

CVE-2021-28168 — jersey-common

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

Description

Impact

Workaround

Patches

References

Similar Vulnerabilities

Affected Packages

Affected Products

Detection & mitigation playbook

Detect

Fix

Workarounds

Fixing This On Your OS

Frequently Asked Questions

Is CVE-2021-28168 in your dependencies?