What is CVE-2021-28164?

CVE-2021-28164 is a medium-severity vulnerability in Eclipse Jetty, classified under Information Disclosure. CVSS score: 5.3/10. Published 2021-04-01.

How severe is CVE-2021-28164?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2021-28164 known to be exploited?

27 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Eclipse Jetty

CVE-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Vulnerability class: Information Disclosure

Published 2021-04-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.824 (99.7th percentile), scored 2026-10-16.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.824 · newest: 0.824 · change: 0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5 (Third Party Advisory, Mitigation)
lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5… (mailing-list)
lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8c… (mailing-list)
lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405e… (mailing-list)
lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47… (mailing-list)
lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd2… (mailing-list)
lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e9… (mailing-list)
lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc4… (mailing-list)
lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a1… (mailing-list)
lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5c… (mailing-list)

Frequently asked questions

What is CVE-2021-28164?: CVE-2021-28164 is a medium-severity vulnerability in Eclipse Jetty, classified under Information Disclosure. CVSS score: 5.3/10. Published 2021-04-01.
How severe is CVE-2021-28164?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2021-28164 known to be exploited?: 27 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.