CVE-2021-3101: Hotdog Container Escape

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-19 · updated 2026-06-17
Weakness: CWE-250

Description

Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.

Affected products

Amazon Web Services Hotdog: before 1.0.1 — fixed in 1.0.1

How to fix

Upgrade to a fixed version: Amazon Web Services Hotdog 1.0.1. Check the vendor advisory for mitigations.

References

https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-qfhv-c5cc-mhgp
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities
https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-qfhv-c5cc-mhgp
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities

Get alerted when CVE-2021-3101 or the next vulnerability affects your stack