CVE-2021-28167

Published: Apr 21, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.

Affected (1)

Products: Eclipse: Openj9

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Openj9	Up to 0.25.0

Related CWEs

Missing Initialization of Resource

The product does not initialize a critical resource.

References (4)

https://github.com/eclipse/openj9/issues/12016

Source: emo@eclipse.org

ExploitPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20240621-0006/

Source: emo@eclipse.org

https://github.com/eclipse/openj9/issues/12016

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20240621-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.