Package
hadoop-3.5
Component
netty-handler
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-75595 is fixed in netty-handler 4.1.137.Final (https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5). The affected copy is bundled inside the HBase client jar hbase-shaded-client-byo-hadoop 2.6.7-hadoop3, which the Hadoop timeline service ships and which cannot be updated independently. The newest HBase releases, 2.6.7 and 3.0.0, both bundle netty 4.1.131.Final through hbase-thirdparty 4.1.14; hbase-thirdparty has moved to netty 4.1.139.Final on its development branch, but no release with it has been published. Waiting for the first upstream release containing the fix.
Status