Package
apache-polaris
Component
jetty-http
Latest update
3.7
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
jetty-http is not a declared dependency of this package. It arrives as a transitive of solr-solrj 8.11.3, via runtime/server -> polaris-extensions-auth-ranger -> org.apache.ranger:authz-embedded -> ranger-audit-dest-solr -> solr-solrj, which pins the Jetty 9.4.x client stack.
Upstream Jetty published this fix only for the 12.0.x and 12.1.x lines, in 12.0.31 and 12.1.5. Every 9.4.x release remains affected, including 9.4.58.v20250814, which OSV records as last-affected for the 9.4 line and which is the last 9.4.x release on Maven Central. No 9.4.59 or later exists, so no fixed 9.4.x release is available.
Jetty has no entry in gradle/libs.versions.toml and is not managed by the Quarkus platform BOM, so the build exposes no version lever, and forcing Jetty 12 would break solr-solrj 8.11.3, which is compiled against the Jetty 9.4 client API.
Remediation requires Apache Ranger to publish an audit destination built on a Solr client that resolves a fixed Jetty release.
Status