Skip to content

starrocks

v4.0.11 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

analytics big-data cloudnative database datalake delta-lake
+14 more
distributed-database hudi iceberg join lakehouse lakehouse-platform mpp olap real-time-analytics real-time-updates realtime-database sql star-schema vectorized

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

StarRocks 4.0.11 upgrades libthrift to 0.23.0 fixing a security vulnerability and introduces several behavior changes across APIs, configuration, and runtime.

Why it matters: Addresses a CVE in libthrift (severity 90) and alters API error handling, transaction‑scope SHOW statements, Java UDF/UDAF type support, default column checker, and resolves a memory leak; operators must review impacted code paths before upgrade.

Summary

AI summary

Broad release touches Behavior Changes, https://github.com/StarRocks/starrocks/pull/73199, https://github.com/StarRocks/starrocks/pull/72798, and https://github.com/StarRocks/starrocks/pull/73064.

Changes in this release

Security Critical

Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE).

Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE).

Source: llm_adapter@2026-06-09

Confidence: high

Breaking High

`get_json_string` and other `get_json_*` functions now return JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION.

`get_json_string` and other `get_json_*` functions now return JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION.

Source: llm_adapter@2026-06-09

Confidence: high

Breaking High

`pipeline_enable_large_column_checker` is now enabled by default.

`pipeline_enable_large_column_checker` is now enabled by default.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

SHOW statements (e.g., SHOW GRANTS, SHOW WAREHOUSES) are now allowed inside explicit transactions.

SHOW statements (e.g., SHOW GRANTS, SHOW WAREHOUSES) are now allowed inside explicit transactions.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Java UDAF and UDTF now support STRUCT arguments and return types.

Java UDAF and UDTF now support STRUCT arguments and return types.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Scalar Java UDF now supports STRUCT arguments.

Scalar Java UDF now supports STRUCT arguments.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Java UDF now supports DATE and DATETIME types.

Java UDF now supports DATE and DATETIME types.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Java UDF now supports nested ARRAY/MAP types.

Java UDF now supports nested ARRAY/MAP types.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Added FE configuration `deploy_serialization_min_thread_pool_size`.

Added FE configuration `deploy_serialization_min_thread_pool_size`.

Source: llm_adapter@2026-06-09

Confidence: high

Performance Low

Lake write-path load spill files use a flat, single-level directory layout with transaction ID in filenames and are reclaimed by txn-id-based vacuum.

Lake write-path load spill files use a flat, single-level directory layout with transaction ID in filenames and are reclaimed by txn-id-based vacuum.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Performance Low

Avoided a redundant 'latestSnapshot()' call in 'PaimonMetadata#getTableVersionRange'.

Avoided a redundant 'latestSnapshot()' call in 'PaimonMetadata#getTableVersionRange'.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Bugfix Medium

Fixed memory leak introduced by the UDAF cache.

Fixed memory leak introduced by the UDAF cache.

Source: llm_adapter@2026-06-09

Confidence: high

Bugfix Medium

Fixed FE file‑descriptor leak by reusing HttpClient instances.

Fixed FE file‑descriptor leak by reusing HttpClient instances.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed incorrect implementation in aggregate combined functions.

Fixed incorrect implementation in aggregate combined functions.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Resolved issue where per-partition coordinator claim was not re-recorded on every sender's open, preventing txn log loss.

Resolved issue where per-partition coordinator claim was not re-recorded on every sender's open, preventing txn log loss.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed read failure on Iceberg tables using a custom LocationProvider by lazily initializing it in SerializableTable.

Fixed read failure on Iceberg tables using a custom LocationProvider by lazily initializing it in SerializableTable.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Replaced incompatible 'de.javakaffee' UnmodifiableCollectionsSerializer with Java 17‑compatible version, fixing serialization failures.

Replaced incompatible 'de.javakaffee' UnmodifiableCollectionsSerializer with Java 17‑compatible version, fixing serialization failures.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

HdfsFsManager copy error messages now include the underlying cause.

HdfsFsManager copy error messages now include the underlying cause.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed concurrent SegmentFlushTask race in DeltaWriter::commit().

Fixed concurrent SegmentFlushTask race in DeltaWriter::commit().

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Propagates sort‑merge provider errors to fragment context instead of losing them.

Propagates sort‑merge provider errors to fragment context instead of losing them.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Ensures Ranger row‑filter/masking policies on Hive views are applied, fixing skipped policy enforcement.

Ensures Ranger row‑filter/masking policies on Hive views are applied, fixing skipped policy enforcement.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Parquet broker load errors now include file/column/row context.

Parquet broker load errors now include file/column/row context.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Resolved slot lookup failure for output slots with empty col_name in Spark connector external scan.

Resolved slot lookup failure for output slots with empty col_name in Spark connector external scan.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed SinkBuffer crash during graceful exit.

Fixed SinkBuffer crash during graceful exit.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Addressed query cache conflicts with local shuffle aggregation.

Addressed query cache conflicts with local shuffle aggregation.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed use‑after‑free of Hive partition descriptor across fragment teardown.

Fixed use‑after‑free of Hive partition descriptor across fragment teardown.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Resolved thread‑safety issue in lake vacuum by using localtime_r.

Resolved thread‑safety issue in lake vacuum by using localtime_r.

Source: granite4.1:30b@2026-06-09-audit

Confidence: high

Bugfix Low

Fixed race condition between PipelineTimerTask doRun and unscheduling during query context destruction.

Fixed race condition between PipelineTimerTask doRun and unscheduling during query context destruction.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Bugfix Low

Reduced lock contention on read‑only query‑engine paths by relaxing DB locks.

Reduced lock contention on read‑only query‑engine paths by relaxing DB locks.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Bugfix Low

Fixed materialized view refresh failure with SQL Server tables in a JDBC catalog.

Fixed materialized view refresh failure with SQL Server tables in a JDBC catalog.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Bugfix Low

Resolved JNI local‑reference leak in JDBCScanner::_init_jdbc_scanner.

Resolved JNI local‑reference leak in JDBCScanner::_init_jdbc_scanner.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Bugfix Low

Prevented partition TopN from losing a child's output column.

Prevented partition TopN from losing a child's output column.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Refactor Low

Skipped redundant partition key expression building when an 'add_partition_value' deduplication hit occurs.

Skipped redundant partition key expression building when an 'add_partition_value' deduplication hit occurs.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Refactor Low

Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination.

Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination.

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

Full changelog

Release Date: June 5, 2026

Behavior Changes

  • get_json_string and the other get_json_* functions now return the JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION. The default behavior (returning NULL when the mode is disabled) is unchanged. #73199
  • pipeline_enable_large_column_checker is now enabled by default. #72798

Improvements

  • Lake write-path load spill files now use a flat, single-level directory layout with the transaction ID baked into each filename, and are reclaimed by a txn-id-based vacuum pass. This moves bulk deletes off the write hot path and lets vacuum clean up spill files leaked by BE crashes. #73064
  • SHOW statements (such as SHOW GRANTS and SHOW WAREHOUSES) are now allowed inside an explicit transaction, so BI/JDBC clients that automatically issue SHOW no longer break the transaction flow. #72954
  • Java UDAF and UDTF now support STRUCT arguments and return types. #72911
  • Scalar Java UDF now supports STRUCT arguments. #72620
  • Java UDF now supports DATE and DATETIME types. #72337
  • Java UDF now supports nested ARRAY/MAP types. #72283
  • Added the FE configuration deploy_serialization_min_thread_pool_size. #72274
  • Skipped redundant partition key expression building when an add_partition_value deduplication hit occurs. #73156
  • Avoided a redundant latestSnapshot() call in PaimonMetadata#getTableVersionRange. #72892
  • Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination. #72823

Bug Fixes

The following issues have been fixed:

  • A memory leak introduced by the UDAF cache. #74025
  • An incorrect implementation in aggregate combined functions. #74169
  • An issue in shared-data combined txn log mode where the per-partition coordinator claim was not re-recorded on every sender's open, which could drop txn logs. #73962
  • A read failure on Iceberg tables that use a custom LocationProvider, fixed by lazily initializing the LocationProvider in SerializableTable. #73482
  • A serialization failure caused by the de.javakaffee UnmodifiableCollectionsSerializer, now replaced with a Java 17-compatible version. #73458
  • HdfsFsManager copy error messages now include the underlying cause. #73414
  • A concurrent SegmentFlushTask race in DeltaWriter::commit(). #73371
  • Sort merge provider errors are now propagated to the fragment context instead of being lost. #73337
  • An issue where Ranger row-filter/masking policies on Hive views were skipped, so policies on the view or its base tables were not applied. #73265
  • Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE). #73243
  • An FE file-descriptor leak, fixed by reusing HttpClient instances. #73239
  • Parquet broker load errors now include file/column/row context. #73236
  • A slot lookup failure for output slots with an empty col_name in the Spark connector external scan. #73225
  • A crash in SinkBuffer during graceful exit. #73202
  • Query cache conflicts with local shuffle aggregation. #73194
  • A use-after-free of the Hive partition descriptor across fragment teardown. #73176
  • A thread-safety issue in lake vacuum, fixed by using localtime_r. #73088
  • A race condition between PipelineTimerTask doRun and unscheduling during query context destruction. #73082
  • Lock contention on read-only query-engine paths, reduced by relaxing DB locks. #73067
  • An materialized view refresh failure with SQL Server tables in a JDBC catalog. #72962
  • A JNI local-reference leak in JDBCScanner::_init_jdbc_scanner. #72913
  • An issue where partition TopN could lose a child's output column. #72848
  • An incorrect plan caused by not clearing LambdaArgument.transformedOp before INSERT OVERWRITE re-planning. #72832
  • The coordinator lock was held during external resource cleanup. #72830
  • Locker rollback is now exception-safe and the unlock order is fixed. #72789
  • An incorrect byte order in ColumnDict.merge, now using unsigned byte order. #72778
  • A stack-buffer-overflow when formatting into a temporary std::string. #72728
  • The HAVING clause is now checked when disabling aggregation spill on a small LIMIT. #72705
  • A hang caused by joining forwarded RPCs when draining the runtime_filter worker. #72626
  • Incorrect lazy-materialization slot nullability for a materialized view over an outer join. #72621
  • merge_condition was not preserved when applying a normal rowset commit. #72542
  • Lock contention in TabletScheduler / TabletSchedCtx hot paths during clone, reduced by relaxing DB locks. #72475
  • Locker did not roll back a partial intensive-lock acquisition. #72423
  • A spillable hash join probe crash. #72397
  • COALESCE children are now cast to a common type in the JOIN USING transformer. #72338
  • DB READ lock was held too broadly for single-table proc directories, now relaxed to per-table. #72334
  • A memory leak when caching the materialized view plan context. #72300
  • FSE-v2 did not set the schema for shared-data sorted schema change. #72235
  • ConsistencyChecker held a DB READ lock too broadly in periodic scans, now relaxed to per-table READ. #72218
  • A BE crash when querying information_schema.warehouse_queries. #72019
  • A trailing \r was not stripped before the closing enclose in CRLF CSV inputs. #71866
  • Paimon primary key columns were incorrectly marked as non-nullable when querying an external catalog. #71660
  • A redundant double slash was created when constructing the JDBC URL if the URI already ended with a trailing slash, breaking strict drivers such as ClickHouse. #70992

Security Fixes

  • dep: libthrift upgraded to 0.23.0 to address a CVE security vulnerability

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track starrocks

Get notified when new releases ship.

Sign up free

About starrocks

The world's fastest open query engine for sub-second analytics both on and off the data lakehouse. With the flexibility to support nearly any scenario, StarRocks provides best-in-class performance for multi-dimensional analytics, real-time analytics, and ad-hoc queries. A Linux Foundation project.

All releases →

Related context

Beta — feedback welcome: [email protected]