You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by "Dishti Kundra (Jira)" <ji...@apache.org> on 2026/02/25 13:03:00 UTC

[jira] [Created] (RANGER-5502) Upgrade Netty to 4.1.30.Final

Dishti Kundra created RANGER-5502:
-------------------------------------

             Summary: Upgrade Netty to 4.1.30.Final
                 Key: RANGER-5502
                 URL: https://issues.apache.org/jira/browse/RANGER-5502
             Project: Ranger
          Issue Type: Task
          Components: Ranger
    Affects Versions: 3.0.0, 2.8.0
            Reporter: Dishti Kundra


The current Apache Ranger 2.8.0 tag release and the master branch package Netty version 4.1.24, which contains multiple known security vulnerabilities, including [CVE-2025-59419|https://nvd.nist.gov/vuln/detail/CVE-2025-59419]. This vulnerability has been addressed in Netty version 4.1.28.Final and later.

However, Netty 4.1.28.Final still includes [CVE-2025-67735|https://vulnerabilities.ncsc.nl/vulnerability.html?id=2025/cve-2025-67735#]. To remediate all identified vulnerabilities, we propose upgrading Netty to version 4.1.30.Final.

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)