Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Apache NiFi and Druid FIPS exposed to Netty security risk

published 4 days ago
Summary

Both Apache NiFi and Druid FIPS rely on the Netty networking library, which contains a flaw that could be exploited by attackers. This may allow a remote user to disrupt service or execute unintended actions. Update the Netty component to the latest patched version to protect these systems.

What to do
  • Update cleanstart apache-nifi to version 2.9.0-r2.
  • Update cleanstart druid-fips to version 34.0.0-r4.
  • Update cleanstart druid-fips to version 36.0.0-r3.
  • Update cleanstart druid-fips to version 37.0.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart apache-nifi < 2.9.0-r2
Fix: upgrade to 2.9.0-r2
CleanStart cleanstart druid-fips < 34.0.0-r4
< 36.0.0-r3
< 37.0.0-r1
Fix: upgrade to 34.0.0-r4
Original advisory text
Netty is a network application framework for development of protocol servers and clients
CVE-2026-44249 affects multiple packages. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-RK35296 · OSV
Track software like this
Free during beta