Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
Apache NiFi and Druid FIPS could run malicious code
published 4 days ago
Summary
Both Apache NiFi and Druid FIPS use a network library that can be manipulated to execute unwanted code on the server. This could let an attacker take control of the system or disrupt its operation. Update to the latest versions of these products as soon as possible to apply the fixes.
What to do
- Update cleanstart apache-nifi to version 2.9.0-r5.
- Update cleanstart druid-fips to version 34.0.0-r4.
- Update cleanstart druid-fips to version 36.0.0-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.9.0-r5 Fix: upgrade to 2.9.0-r5
|
| CleanStart | cleanstart | druid-fips |
< 34.0.0-r4 < 36.0.0-r3 Fix: upgrade to 34.0.0-r4
|
Original advisory text
Netty is an asynchronous, event-driven network application framework
CVE-2026-59901 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-RT73394 · OSV
Track software like this
Free during beta