CVE-2021-28170: Eclipse Jakarta Expression Language

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Affected products

• Eclipse Jakarta Expression Language: up to and including 3.0.3
• Oracle Communications Cloud Native Core Policy: version 1.14.0 only
• Oracle WebLogic Server: version 14.1.1.0.0 only
• Quarkus Quarkus: before 2.3.0 (fixed in 2.3.0)

Published 2021-05-26. Last modified 2026-06-17.