CVE-2021-28167

PoC —

CVSS 3.1

6.5 medium

EPSS

1%p64

Published

Apr 21, 2021 (Apr 21, 2021)

Modified

Jun 17, 2026

Description

In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.

Vendors: eclipse
Products: openj9
Weakness: CWE-909
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.