CVE-2021-34429: Eclipse Jetty

Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days.

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Affected products

Eclipse Jetty: from 9.4.37, before 9.4.43 (fixed in 9.4.43); from 10.0.1, before 10.0.6 (fixed in 10.0.6); from 11.0.1, before 11.0.6 (fixed in 11.0.6)
Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
Netapp E-Series Santricity Web Services: affected versions not specified
Netapp Element Plug-In For vCenter Server: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Snap Creator Framework: affected versions not specified
Netapp Snapcenter Plug-In: affected versions not specified
Netapp Solidfire: affected versions not specified
Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.5.0 only
Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.14.0 only
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.0.2
Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
Oracle Rest Data Services: before 22.1.1 (fixed in 22.1.1)
Oracle Retail Eftlink: version 20.0.1 only
Oracle Stream Analytics: before 19.1.0.0.6.4 (fixed in 19.1.0.0.6.4); version 19c only

Published 2021-07-15. Last modified 2026-06-17.