CVE-2021-2161

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

• https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposuresThird Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/
• https://security.gentoo.org/glsa/202209-05Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210513-0001/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4899Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2021.htmlPatch, Vendor Advisory
• https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposuresThird Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/
• https://security.gentoo.org/glsa/202209-05Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210513-0001/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4899Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2021.htmlPatch, Vendor Advisory

Published

Apr 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21604Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows at…8
• CVE-2021-21605Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows us…8
• CVE-2021-21606Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperl…4.3
• CVE-2021-21607Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not …6.5
• CVE-2021-21608Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not …5.4
• CVE-2021-21609Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not …5.3
• CVE-2021-21610Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not …6.1
• CVE-2021-21611Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not …5.4
• CVE-2021-21612Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier store…5.5
• CVE-2021-21613Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape T…6.1
• CVE-2021-21614Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores cre…5.5
• CVE-2021-21615Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files…5.3