amliuyong opened a new issue, #10859: URL: https://github.com/apache/paimon/issues/10859
### Search before asking - [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar. ### Paimon version 2.1.0, and master (source at 071e9ee, nightly snapshot jars `2.2-20261029.000959`). ### Compute Engine Not engine specific. The libraries are bundled in Paimon's own jars (`paimon-api`, `paimon-format`, `paimon-s3`), and through `paimon-api` and `paimon-format` also in `paimon-bundle` and `paimon-flink-*`. ### Minimal reproduce step Scan the released 2.1.0 jars, or the 2.2-SNAPSHOT jars, with Trivy (0.71.0, vulnerability DB of 2026-10-28): ``` trivy rootfs --scanners vuln <directory with the paimon-api, paimon-format, paimon-bundle and paimon-flink-1.20 jars> ``` Trivy finds the `paimon-api` and `paimon-format` rows below through the bundled `pom.properties`. The paimon-shade jars and the S3 plugin do not keep `META-INF/maven`, so scanners cannot see what is inside them. For those, I took the versions from the paimon-shade NOTICE and from `mvn dependency:list` on `paimon-hadoop-shaded-3.4` and `paimon-s3-impl`. I then checked that the published jar contains the original artifact's classes byte for byte; for the relocated Jackson copies, I read the version from their `PackageVersion` class. Finally, I scanned the original artifacts. ### What doesn't meet your expectations? The bundled versions below have published advisories. Only critical, high and medium advisories are listed. This is a scanner-based inventory: I have not assessed whether Paimon's code paths reach the affected functionality. "Fixed in" is the lowest version line in which every listed advisory is fixed. **paimon-shade 0.8.0**, the latest release; master pins `paimon.shade.version` 0.8.0. All of `paimon-shade-jackson-2` and `paimon-shade-guava-30` is inside `paimon-api`. | Component | Version | Critical / high | Medium | Fixed in | |---|---|---|---|---| | jackson-core | 2.14.2 | CVE-2025-52999, CVE-2026-68494, CVE-2026-89425 | | 2.18.11, 2.21.7 | | jackson-databind | 2.14.2 | CVE-2026-54512, CVE-2026-54513, CVE-2026-68497, CVE-2026-91776, CVE-2026-91777 | CVE-2026-19032, CVE-2026-54514, CVE-2026-54515, CVE-2026-59889, CVE-2026-77310, CVE-2026-83557 | 2.18.11, 2.21.7 | | snakeyaml (for jackson-dataformat-yaml) | 1.33 | CVE-2022-1471 | | 2.0 | | guava | 30.1.1-jre | CVE-2026-102554 | CVE-2023-2976 | 33.7.2 | The Jackson upgrade in paimon-shade is already tracked in #7431 and apache/paimon-shade#22. I list it here so the inventory is complete. **paimon-format** | Component | Version | Critical / high | Medium | Fixed in | |---|---|---|---|---| | jackson-core | 2.14.3 | CVE-2025-52999, CVE-2026-68494, CVE-2026-89425 | | 2.18.11, 2.21.7 | | jackson-databind | 2.14.3 | CVE-2026-54512, CVE-2026-54513, CVE-2026-68497, CVE-2026-91776, CVE-2026-91777 | CVE-2026-19032, CVE-2026-54514, CVE-2026-54515, CVE-2026-59889, CVE-2026-77310, CVE-2026-83557 | 2.18.11, 2.21.7 | | protobuf-java | 3.19.6 | CVE-2024-7254 | | 3.25.5, 4.27.5, 4.28.2 | | commons-lang | 2.6 | | CVE-2025-48924 | no 2.x release (fixed in commons-lang3 3.18.0) | **paimon-api** | Component | Version | Critical / high | Medium | Fixed in | |---|---|---|---|---| | httpcore5 | 5.3.6 | CVE-2026-54399 | | 5.4.3 | | httpcore5-h2 | 5.3.6 | CVE-2026-54428 | | 5.4.3 | | httpclient5 | 5.5.1 | | CVE-2026-64607 | 5.6.3 | **paimon-s3** plugin. The contents are the same in 2.1.0 and 2.2-SNAPSHOT. Most of these come in through `paimon-hadoop-shaded-3.4` (Hadoop 3.4.2); the unrelocated Jackson 2.12.6.1/2.14.2 and netty-codec-http/http2 4.1.115 come with the AWS SDKs. | Component | Version | Critical / high | Medium | Fixed in | |---|---|---|---|---| | jackson-core | 2.14.2, and 2.12.7 (relocated) | CVE-2025-52999, CVE-2026-68494, CVE-2026-89425 | 2.12.7 also: CVE-2025-49128 | 2.18.11, 2.21.7 | | jackson-databind | 2.12.6.1 | CVE-2022-42003, CVE-2022-42004, CVE-2026-54512, CVE-2026-54513, CVE-2026-91776, CVE-2026-91777 | CVE-2026-19032, CVE-2026-50193, CVE-2026-54514, CVE-2026-54515, CVE-2026-59889, CVE-2026-77310, CVE-2026-83557 | 2.18.11, 2.21.7 | | jackson-databind | 2.12.7.1 (relocated) | CVE-2026-54512, CVE-2026-54513, CVE-2026-91776, CVE-2026-91777 | as for 2.12.6.1 | 2.18.11, 2.21.7 | | guava | 27.0-jre, and 32.0.1 (`hadoop-shaded-guava` 1.4.0) | CVE-2026-102554 | 27.0-jre also: CVE-2023-2976 | 33.7.2 | | snappy-java | 1.1.10.8 | CVE-2026-108106, CVE-2026-93451 | CVE-2026-116590 | 1.1.10.9 | | ion-java | 1.0.2 | CVE-2024-21634 | | 1.10.5 | | netty-handler | 4.1.118.Final | CVE-2026-75595 (critical), CVE-2026-44249, CVE-2026-45416, CVE-2026-50010 | CVE-2026-75596 | 4.1.137.Final | | netty-codec | 4.1.118.Final | CVE-2026-42583, CVE-2026-59901 | CVE-2025-58057 | 4.1.136.Final | | netty-codec-http | 4.1.115.Final | CVE-2026-33870, CVE-2026-42584, CVE-2026-42587, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745 | CVE-2025-67735, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42585, CVE-2026-50020, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, CVE-2026-59921 | 4.1.137.Final | | netty-codec-http2 | 4.1.115.Final | CVE-2025-55163, CVE-2026-33871, CVE-2026-42587, CVE-2026-56819 | CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-59900 | 4.1.136.Final | | bcprov-jdk18on | 1.78.1 | CVE-2025-14813 (critical), CVE-2026-8763 (critical), CVE-2026-13506 | CVE-2026-0636 | 1.85 | | commons-configuration2 | 2.10.1 | | CVE-2026-45205 | 2.15.0 | ### Anything else? Requested upgrades: - a paimon-shade release with current Jackson (and SnakeYAML 2.x) and Guava, and master moving to it; - protobuf-java 3.25.5 or later in `paimon-format`, and a replacement for commons-lang 2.6, which has no fixed 2.x release; - httpcore5 and httpcore5-h2 5.4.3 or later, and httpclient5 5.6.3 or later; - in the S3 plugin: snappy-java 1.1.10.9, a current netty 4.1.x, bcprov, commons-configuration2 and ion-java, plus Jackson and Guava as far as Hadoop and the AWS SDKs allow. I only looked at the artifacts above, not at the other filesystem plugins. Side note: some NOTICE files differ from what the jars contain. - `paimon-hadoop-shaded-3.4` lists commons-compress 1.21, commons-configuration2 2.1.1, commons-io 2.8.0, dnsjava 2.1.7 and woodstox-core 5.3.0. The jar contains 1.26.1, 2.10.1, 2.16.1, 3.6.1 and 5.4.0. The NOTICE does not mention the netty and Bouncy Castle classes the jar bundles. - `paimon-format` lists Jackson 2.14.2 and commons-compress 1.22. Its `pom.properties` say 2.14.3 and 1.26.2. ### Are you willing to submit a PR? - [ ] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
