Putki Security

Affected on all supported releases. A vulnerable copy of Netty is bundled inside the gRPC transport library on the Hop runtime classpath. Most vulnerability scanners will not report it, because the bundling renames the library and hides its version — we confirmed it by opening the archive. No upstream release of that library yet carries a fixed Netty, so there is nothing to upgrade to; 2026.09 already carries a fixed copy of the standalone library.

Affected, by a narrow path, and not being patched on the current lines. Bouncy Castle is bundled inside JRuby inside the documentation-generation plugin. Reaching the flaw needs a generated PDF that fetches a resource over HTTPS from a certificate authority using name constraints — a combination no Putki deployment is known to produce. The fix is a JRuby upgrade, which arrives with Apache Hop rather than from us.

Hop's own HTTP stack runs Jetty 12.1.12, which carries the fix; the only vulnerable copies in the image are bundled inside the Spark and Hadoop client libraries, which never start a server because the Spark engine is not shipped. Fixed on 2026.03 and 2026.06 by the 2026.03.06 and 2026.06.01 patch releases. Older unsupported lines carry a vulnerable Jetty on the request path and are not patched.

Hop's own HTTP stack runs Jetty 12.1.12, which carries the fix; the only vulnerable copies in the image are bundled inside the Spark and Hadoop client libraries, which never start a server because the Spark engine is not shipped. Fixed on 2026.03 by the 2026.03.06 patch release; 2026.06 already shipped a fixed Jetty. Older unsupported lines carry a vulnerable Jetty on the request path and are not patched.

Putki Web's pipeline execution API is reachable without authentication in the shipped default configuration. Putki Web is not supported for production use before 2026.12, and deployments should keep it behind their own access controls until then. Apache Hop 2.20 closes this by default and 2026.12 adopts it.

Not affected. Netty is present underneath the Google Cloud client libraries, as a client transport. Putki serves HTTP on Jetty, and nothing in the product uses the Netty component this flaw is in.

Not affected. Netty is present underneath the Google Cloud client libraries, as a client transport. Putki serves HTTP on Jetty, and nothing in the product uses the Netty component this flaw is in.

Not affected. The flaw is in Tomcat's DIGEST authenticator, which is only active when a web application asks for DIGEST authentication. Putki Web does not, in either configuration it ships. Apache Hop 2.20's authentication is handled by the application rather than by Tomcat, so this does not become reachable later.

Not affected. Netty is present underneath the Google Cloud client libraries, as a client transport. Putki serves HTTP on Jetty, and nothing in the product uses the Netty component this flaw is in.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. The flaw is in Junrar's extract-to-folder helper. The Tika transform reads RAR entries as streams to pull out text and metadata and never extracts to disk, so the affected code is never called.

The flaw needs an attacker to hand FreeMarker a malformed locale while it loads a template. FreeMarker ships only as a dependency of the vCard library used by the vCard transform, and that library uses it for one thing: rendering contacts as an HTML page, which Hop never does. Even that code loads a single fixed template and never takes a locale from input.

Not affected. The flaw requires a security rule that applies to some HTTP methods and not others. None of the rules Putki Web ships is written that way, so the condition the flaw needs does not arise — and that holds whether or not authentication is enabled.

Not affected in the shipped default, which runs Putki Web without authentication and so has no access rules for the flaw to bypass. Putki Web also ships an optional JDBC-backed login that is not in production use anywhere and is being replaced in 2026.12; with that enabled we do not claim this is safe. See the note below.

Not affected. Netty is present underneath the Google Cloud client libraries, as a client transport. Putki serves HTTP on Jetty, and nothing in the product uses the Netty component this flaw is in.

Not affected. Netty is present underneath the Google Cloud client libraries, as a client transport. Putki serves HTTP on Jetty, and nothing in the product uses the Netty component this flaw is in.

Not affected. Perl is present in the base image and nothing in Putki runs it. The flaw also needs a regular expression with more than 65535 fixed-string branches, which no Putki code could produce even if it did.

Not affected. The plugin archives have never contained ZooKeeper. The container images briefly inherited it from an upstream base during 2026.09 development; those jars and the Beam and Spark engines that pulled them in were removed before release, and the build now fails if they reappear.

Affected in the monitoring image on releases up to 2026.09, through the same unmaintained third-party Grafana plugin as CVE-2024-8986, and removed in the same change. The same advisory also matches a start-up helper in the warehouse database image, where it is not affected: that helper never makes network connections, which is what the flaw requires.

Affected in the monitoring image on releases up to 2026.09, through the same unmaintained third-party Grafana plugin as CVE-2024-8986, and removed in the same change.

Affected in the monitoring image on releases up to 2026.09, through the same unmaintained third-party Grafana plugin as CVE-2024-8986, and removed in the same change.

This reaches the monitoring image only through an unmaintained third-party Grafana plugin that has since been removed; the plugin provided a datasource no dashboard used, and it never served HTTP.

Affected in the monitoring image on releases up to 2026.09, through a third-party Grafana datasource plugin whose last update was June 2024. The plugin provided a datasource that no dashboard used and has been removed for 2026.12. It is not reachable from any dashboard Putki ships.

Affected in the monitoring image on 2026.03 and 2026.06, and resolved in 2026.09 by a newer Grafana base image.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. The flaw is in curl's optional GSASL authentication support, which the curl shipped in this image is not built against — the library it would need is not installed. Nothing in the image invokes curl in any case.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Not affected. curl is present in this image only because the base image ships it; nothing in Putki invokes it or links against libcurl, so the flaw has no way to be reached.

Affected in the monitoring image on releases up to 2026.09, through the same unmaintained third-party Grafana plugin as CVE-2024-8986, and removed in the same change. The same advisory also matches a start-up helper in the warehouse database image, where it is not affected: that helper never makes network connections, which is what the flaw requires.