Package
starrocks-be-4.0-connector-kudu
Component
netty-handler
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The fix for this advisory is netty-handler 4.1.137.Final (4.2.17.Final on the 4.2 line). This detection is against the copy of netty relocated inside kudu-client, a shaded jar published by Apache Kudu and used by the StarRocks Kudu connector, where the classes are rewritten under a Kudu-internal package name and cannot be replaced by an io.netty dependency pin. This build ships kudu-client 1.17.1, which carries netty 4.1.110.Final. Upgrading does not resolve it: kudu-client 1.18.1 is the most recent release and shades netty 4.1.115.Final, which this advisory still covers. This will be resolved when Apache Kudu publishes a kudu-client release that shades netty 4.1.137.Final or later.
Status