pinot

vrelease-1.5.1 scope: release Security

This release includes 19 security fixes for security teams reviewing exposed deployments.

Published 1mo Data Warehouses & Analytics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 19 known CVEs

Topics

java

Affected surfaces

deps

Summary

AI summary

Security patch release resolves multiple CVEs by updating dependencies and excluding Jetty

Full changelog

Apache Pinot 1.5.1

Apache Pinot 1.5.1 is a security patch release based on 1.5.0. It contains only dependency updates and dependency-exclusion changes to resolve reported CVEs — no functional, API, configuration, or wire-format changes. A vulnerability scan of the 1.5.1 binary distribution reports 0 critical and 0 high findings.

This addresses the CVEs reported in #18593, plus additional Jetty, BouncyCastle, and commons-configuration2 findings surfaced during release verification.

Security fixes

| Dependency | 1.5.0 → 1.5.1 | CVEs addressed |
|---|---|---|
| Netty (netty-bom) | 4.1.122.Final → 4.1.134.Final | CVE-2025-55163, CVE-2025-59419, CVE-2026-33870, CVE-2026-33871, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 |
| Apache Log4j Core | 2.25.3 → 2.26.0 | CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-34481 |
| async-http-client | 3.0.7 → 3.0.10 | CVE-2026-45300 |
| Apache HttpClient 5 | 5.6 → 5.6.1 | CVE-2026-40542 |
| Apache Pulsar (bundles BouncyCastle) | 4.0.9 → 4.0.10 (bcprov/bcpkix/bcutil → 1.84) | CVE-2026-5598, CVE-2026-0636, CVE-2026-5588 |
| commons-configuration2 | 2.13.0 → 2.15.0 | CVE-2026-45205 |

CVE-2026-2332 (Jetty request smuggling)

The only Jetty in Pinot's distribution was Hadoop's embedded HttpServer2, which Pinot never starts. As of 1.5.1 it is excluded from the Hadoop dependencies and stripped from the shaded jars (#18659), so Jetty no longer ships in the distribution at all. (Jetty 9.4.x itself is end-of-life with no available patch; removing the unused artifact is the resolution.)

Upgrade notes

Drop-in security update for 1.5.0 — no behavioral changes.

Full Changelog: https://github.com/apache/pinot/compare/release-1.5.0...release-1.5.1

Security Fixes

dep: CVE-2025-55163, CVE-2025-59419, CVE-2026-33870, CVE-2026-33871, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 (Netty 4.1.122 → 4.1.134)
dep: CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-34481 (Apache Log4j Core 2.25.3 → 2.26.0)
dep: CVE-2026-45300 (async-http-client 3.0.7 → 3.0.10)
dep: CVE-2026-40542 (Apache HttpClient 5 5.6 → 5.6.1)
dep: CVE-2026-5598, CVE-2026-0636, CVE-2026-5588 (Apache Pulsar BouncyCastle upgrade to bcprov/bcpkix/bcutil 1.84)
dep: CVE-2026-45205 (commons-configuration2 2.13.0 → 2.15.0)
Jetty request‑smuggling vulnerability CVE-2026-2332 resolved by excluding the unused Hadoop HttpServer2 Jetty dependency from shaded jars
CVE-2025-59419
CVE-2026-33870
CVE-2026-33871
CVE-2026-42579
CVE-2026-42583
CVE-2026-42584
CVE-2026-42587
CVE-2026-34479
CVE-2026-34480
CVE-2026-34481
CVE-2026-0636
CVE-2026-5588

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pinot

Get notified when new releases ship.

About pinot

Apache Pinot - A realtime distributed OLAP datastore

All releases →