Package
opensearch-fips-3
Component
netty-codec-http
Latest update
Fixed version
3.7.0-r0
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
3.7.0-r0Status
Impact
The runtime bundles netty across the main OpenSearch distribution and multiple plugin subpackages (security-analytics, ml-commons, notifications, repository-, performance-analyzer, security) — each plugin is a separate upstream repository with its own gradle build, and several distribute shaded jars (e.g. security-analytics-commons-.jar) that embed netty internally. Remediating this CVE requires upstream OpenSearch to release a new version with the netty bump propagated across all bundled plugins; patching individual netty pins ad hoc is not tractable without coordinated upstream releases.
Status