Fixed CVEs

This release resolves 895 security vulnerabilities (CVEs) identified across ODP platform components, representing a comprehensive security hardening initiative implemented during the upgrade from version 3.2.3.5-2 to 3.2.3.6-2.

Detailed List of CVEs Addressed

For detailed information about CVEs addressed in this release, see ODP 3.2.3.6-2 Acceldata Open-Source Data Platform CVE Fixes.

Summary of CVEs by component and severity level

You can see the summary of CVEs addressed by components and severity level.

CVE Fix Descriptions

Ambari

• OSV-16011: Removed Apache Hadoop and retained only ODP Hadoop (#490)
• OSV-15922: Upgraded Solr to 8.11.2.2 (for Jetty) (#491)
• OSV-16054: Addressed CVE-2024-29131 by upgrading commons-configuration2 from 2.8.0 to 2.14.0 (#498)
• OSV-16008: Addressed CVE-2026-27830 by upgrading c3p0 from 0.9.5.4 to 0.12.0 (#500)
• OSV-16057: Removed jose4j (#499)
• OSV-15904: Upgraded Ambari Infra Solr to version 8 and aligned with Ambari 2.8 stack (partial) (#501)
• OSV-16084: Addressed CVE-2023-2976 by removing guice-4.0-beta (#497)
• OSV-16055: Addressed CVE-2020-13936 by migrating away from org.apache.velocity (#496)
• OSV-16027: Removed Apache ZooKeeper (#493)
• OSV-16061: Addressed CVE-2022-42889 by excluding commons-text from Solr (#494)
• OSV-15927: Regenerated fast-hdfs-resource 3.2.3.3.2.3.6-2 (#495)

Hadoop

• OSV-10916: Addressed CVE-2024-47561 by upgrading the Hadoop third-party to 1.4.0
• OSV-10934: Addressed CVE-2024-29131 (HADOOP-19123, HADOOP-19532) by upgrading commons-lang3 and commons-configuration2 (#121)
• OSV-10905: Addressed CVE-2025-59419 (HADOOP-19788) by upgrading Netty4 to 4.1.130.Final (#122)
• OSV-3108: Addressed CVE-2025-48734 (HADOOP-18991) by removing commons-beanutils dependency (#123)
• OSV-9565: Upgraded aws-java-sdk to 1.12.797 to address CVE
• HADOOP-19114 / OSV-9569: Upgraded commons-compress to 1.26.1 to address CVEs (#6636)
• OSV-9634: Upgraded nimbus-jose-jwt to address CVE
• OSV-9619 / OSV-9572: Upgraded commons-net and commons-lang to address CVEs
• OSV-10843: Upgraded commons-io to 2.16.1 and fixed deprecated API usage to address CVE-2024-47554 (#145)

Airflow

• ODP-6015 / OCR-2365 / OCR-2388: Fixed CVEs and added build scripts for UBI9 and from-source for 3.2.3.6-2
• OCR-2365 / OCR-2388: Disabled use of LogTemplate table by default (#61880)

Cruise Control 2

• ODP-6342: Upgraded Netty to version 4.1.132.Final

Cruise Control 3

• ODP-6342: Upgraded Netty to version 4.1.132.Final

DRUID

• OSV-10182: Upgraded docker-java-bom and Kubernetes client-java to bump bcprov and address CVE (#59)
• OSV-10193: Upgraded commons-lang3 to address CVE (#60)
• OSV-10179: Upgraded netty4 to address CVE (#61)
• OSV-10189: Upgraded commons-compress to address CVE (#62)
• OSV-10180: Upgraded commons-beanutils to address CVE (#64, #65)
• OSV-10181: Upgraded commons-io to address CVE (#63)
• OSV-10078: Upgraded Avro to address CVE (#66)
• OSV-10093: Upgraded Jackson to address CVE (#67)
• OSV-10159: Upgraded jose4j to address CVE (#68)
• OSV-10107: Upgraded log4j to address CVE (#69)

Flink

• OSV-13324: Addressed CVE-2025-68161 by upgrading log4j to version 2.25.3
• FLINK-38193: Addressed CVE-2025-48924 by upgrading commons-lang3 to version 3.18.0

HBase

• OSV-10265 / HBASE-29293: Addressed CVE-2025-52999 by upgrading OpenTelemetry (#22)
• HBASE-28250: Upgraded JRuby to 9.4.8.0 to address SnakeYAML CVE (#23)
• HBASE-29740: Upgraded lz4-java to 1.8.1+ (#24)
• HBASE-28379: Upgraded third-party dependencies to version 4.1.6
• HBASE-28511: Updated hbase-thirdparty to version 4.1.7
• HBASE-28793: Updated hbase-thirdparty to version 4.1.8
• HBASE-28879: Upgraded hbase-thirdparty to version 4.1.9
• HBASE-29086: Upgraded hbase-thirdparty to version 4.1.10
• HBASE-29200: Upgraded Netty4 to version 4.1.119.Final in main repository

HBase Connectors

• OSV-12156: Upgraded Curator to version 5.6.0 (#14)

Hive

• OSV-9755 / OSV-9725: Upgraded Avro to 1.11.5 to address CVE (#117)
• OSV-9700: Upgraded bcprov-jdk18on to address CVE (#119)
• OSV-9753: Upgraded commons-beanutils to address CVE (#121)
• OSV-9708: Upgraded commons-compress to address CVE (#122)
• OSV-9728: Upgraded commons-lang3 to address CVE
• OSV-9648: Upgraded Netty to address CVE (#124)
• OSV-9747: Upgraded cron-utils to address CVE (#125)
• OSV-9707: Upgraded nimbus-jose-jwt to address CVE (#126)
• OSV-9723: Upgraded xmlsec to address CVE (#127)
• OSV-9724 / HIVE-28417: Upgraded log4j2 to address CVE (#128)
• OSV-10181: Upgraded commons-io to address CVE (#130)
• HIVE-28625: Upgraded Apache Parquet to version 1.14.4 (partially backported)

Impala

• ODP-6342: Upgraded Netty to version 4.1.132.Final
• OSV-11025: Upgraded log4j2 to version 2.25.3 to address CVE
• OSV-11004: Migrated from javax.el to jakarta.el 3.0.4 to address CVE
• OSV-10952: Upgraded aircompressor to version 2.0.3 to address CVE
• OSV-10951: Upgraded jdom2 to version 2.0.6.1 to address CVE
• OSV-11036: Upgraded dnsjava to version 3.6.0 to address CVE
• OSV-11037: Upgraded commons-lang3 to version 3.18.0 to address CVE
• OSV-11051: Added commons-configuration2 version override in dependency management
• OSV-11063: Added Netty dependencies to dependency management for kudu-client
• OSV-11021: Added protobuf-java 3.25.5 and excluded vulnerable versions for kudu-client
• OSV-11056: Added protobuf-java 3.25.5 to dependency management and excluded vulnerable 2.5.0 from HBase dependencies
• OSV-11013: Excluded Jackson from Iceberg to address CVE
• OSV-11046: Upgraded Jackson to version 2.16.1 to address CVE

JupyterHub

• ODP-6226: Upgraded fonttools to version 4.45.1 to address CVE-2025-66034
• OSV-11994 / 12009 / 12016: Addressed CVEs in fonttools, Jinja, and requests
• OSV-12010: Upgraded Protobuf to address high-severity CVE
• OSV-11999 / 11998 / 11997 / 11996 / 11995: Upgraded urllib3 to address CVEs
• OSV-12017 / 12018: Addressed CVEs in setuptools and wheel

Kafka Connect 2

• OSV-10326: Upgraded Avro to version 1.11.5 to address CVE-2024-47561 (#4)
• OSV-10328: Upgraded Jackson to version 2.16.1 to address PRISMA-2023-0067

Kafka Connect 3

• OSV-10326: Upgraded Avro to version 1.11.5 to address CVE-2024-47561 (#4)
• OSV-10328: Upgraded Jackson to version 2.16.1 to address PRISMA-2023-0067

Pinot

• ODP-6342: Upgraded Netty to version 4.1.132.Final
• OSV-10752: Addressed multiple CVEs by upgrading Avro, aircompressor, Netty, commons-beanutils, Jersey, and log4j
• OSV-10752: Excluded vulnerable okio from pinot-parquet module
• OSV-10752: Excluded outdated protobuf libraries from pinot-parquet module
• OSV-10752: Excluded outdated Jackson libraries from pinot-orc module

Spark 3

• ODP-6342: Upgraded Netty to version 4.1.132.Final
• OSV-11406: Addressed CVE-2019-10202
• OSV-11416: Upgraded log4j to version 2.25.3 to address CVE

Sqoop

• OSV-10778: Upgraded Avro to address CVE

Tez

• OSV-9636: Addressed CVE by upgrading Netty4 to 4.1.130
• TEZ-4353 / OSV-9632: Upgraded commons-io to 2.8.0 (#165)

Kafka 3

• OSV-11068 / OSV-11067 / OSV-11076 / OSV-11084 / OSV-11081: Addressed multiple CVEs (#27)

Knox

• OSV-9821 / KNOX-3078: Upgraded protobuf to version 3.25.5 (#57)
• OSV-9834 / KNOX-3178: Upgraded dependencies to address CVEs (#56)

Kudu

• ODP-6342: Upgraded Netty to version 4.1.132.Final
• OSV-9893: Enforced usage of Acceldata ZooKeeper version
• OSV-9892: Upgraded Guava to address CVE-2023-2976
• OSV-14275 / 14276 / 8764 / 14269 / 14221 / 14219 / 14211 / 14209: Addressed multiple Kudu CVEs by upgrading Netty, Guava, commons-configuration2, mssql-jdbc, and aircompressor; and pinning snakeyaml, ZooKeeper, protobuf, dnsjava, and io.airlift:aircompressor versions

Ozone

• OSV-10667: Upgraded commons-fileupload to 1.6 to address CVE-2025-48976
• OSV-10696: Downgraded Netty to 4.1.111.Final for gRPC and Ratis compatibility
• OSV-11049: Upgraded nimbus-jose-jwt to 9.37.4 to address CVE
• OSV-11049: Upgraded Guava to 32.0.1-jre to address CVE
• OSV-11049: Upgraded commons-io to 2.16.1 to address CVE
• OSV-11049: Upgraded commons-lang3 to 3.18.0 to address CVE
• OSV-11049: Upgraded commons-compress to 1.26.1 to address CVE
• OSV-10678: Upgraded commons-beanutils to 1.11.0 to address CVE

Phoenix

• ODP-6342: Upgraded Netty to version 4.1.132.Final
• OSV-11609 / OSV-11602: Addressed CVE-2025-48924 and CVE-2025-68161 by upgrading commons-lang and log4j2
• PHOENIX-7699: Upgraded Jetty to version 9.4.58.v20250814

Registry

• OSV-11646: Upgraded Nimbus to version 10.0.1
• OSV-11653: Upgraded jose4j to version 0.9.6
• OSV-11746: Upgraded commons-beanutils to version 1.11.0
• OSV-11749: Removed Elasticsearch dependency
• OSV-11756: Upgraded dnsjava to version 3.6.0
• OSV-11730: Upgraded Jetty version
• OSV-11664: Removed unused ZooKeeper dependency
• OSV-11658: Upgraded jdom2 version
• OSV-11642: Upgraded jackson-databind to version 2.15.0
• OSV-11742: Removed Jackson 1 dependencies
• OSV-11632: Upgraded commons-text
• OSV-11757: Upgraded SnakeYAML to version 2.0

Livy

• OSV-10425 / OSV-10359 / ODP-6342: Upgraded Netty to version 4.1.132.Final to address CVEs
• OSV-10359: Explicitly included commons-lang3 to address CVE-2025-48924
• OSV-10485: Upgraded commons-lang3 to version 3.18.0 to address CVE

Ranger

• OSV-11137 / ODP-6332: Removed unused Jetty HTTP component jars and upgraded Netty to 4.1.132
• OSV-11108 / OSV-11268: Addressed CVEs by upgrading Elasticsearch and Netty to 4.1.130.Final
• OSV-11027: Upgraded Elasticsearch to 7.17.29 to address CVE
• OSV-11259: Upgraded commons-configuration2 to 2.10.1 to address CVE-2024-29131
• OSV-11256 / OSV-11257: Upgraded Tomcat to version 9.0.115

Zeppelin

• OSV-13027: Updated quartz scheduler to version 2.4.1 (#32)
• OSV-13022: Upgraded commons-vfs2 to version 2.10.0 (#31)
• OSV-12964: Upgraded aliyun-sdk-oss to version 3.18.5 (#30)
• OSV-12963: Upgraded jinjava to version 2.7.6 (#29)