Package
spark-fips-4.1-scala-2.13
Component
jetty-http
Latest update
7.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixable in this package yet. jetty-http 9.4.58.v20250814 is shaded into hadoop-client-runtime-3.5.0.jar. For the Jetty 9.4 line, CVE-2026-2332 is fixed in jetty-http 9.4.60, but 9.4.60 has not been published: the newest Jetty 9.4 release on Maven Central is 9.4.58.v20250814. The only published fixes are in Jetty 12 (12.0.33 and 12.1.7). Apache Hadoop 3.5.0, the newest Hadoop release, builds against Jetty 9.4.58.v20250814. Moving Hadoop to Jetty 12 is a major-version port of its embedded web servers, not a dependency bump, and no Hadoop release has made that move yet.
Waiting for the first upstream release containing the fix. That is either a published jetty-http 9.4.60 or an Apache Hadoop release built on Jetty 12.
References:
Status