Download Latest Version
Apache Pinot 1.5.1 source code.zip (146.0 MB)
Get an email when there's a new version of Pinot
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| Apache Pinot 1.5.1 source code.tar.gz | 2026-06-04 | 138.9 MB | |
| Apache Pinot 1.5.1 source code.zip | 2026-06-04 | 146.0 MB | |
| README.md | 2026-06-04 | 1.8 kB | |
| Totals: 3 Items | 285.0 MB | 0 | |
Apache Pinot 1.5.1
Apache Pinot 1.5.1 is a security patch release based on 1.5.0. It contains only dependency updates and dependency-exclusion changes to resolve reported CVEs — no functional, API, configuration, or wire-format changes. A vulnerability scan of the 1.5.1 binary distribution reports 0 critical and 0 high findings.
This addresses the CVEs reported in [#18593], plus additional Jetty, BouncyCastle, and commons-configuration2 findings surfaced during release verification.
Security fixes
| Dependency | 1.5.0 → 1.5.1 | CVEs addressed |
|---|---|---|
Netty (netty-bom) |
4.1.122.Final → 4.1.134.Final |
CVE-2025-55163, CVE-2025-59419, CVE-2026-33870, CVE-2026-33871, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 |
| Apache Log4j Core | 2.25.3 → 2.26.0 |
CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-34481 |
| async-http-client | 3.0.7 → 3.0.10 |
CVE-2026-45300 |
| Apache HttpClient 5 | 5.6 → 5.6.1 |
CVE-2026-40542 |
| Apache Pulsar (bundles BouncyCastle) | 4.0.9 → 4.0.10 (bcprov/bcpkix/bcutil → 1.84) |
CVE-2026-5598, CVE-2026-0636, CVE-2026-5588 |
| commons-configuration2 | 2.13.0 → 2.15.0 |
CVE-2026-45205 |
CVE-2026-2332 (Jetty request smuggling)
The only Jetty in Pinot's distribution was Hadoop's embedded HttpServer2, which Pinot never starts. As of 1.5.1 it is excluded from the Hadoop dependencies and stripped from the shaded jars (#18659), so Jetty no longer ships in the distribution at all. (Jetty 9.4.x itself is end-of-life with no available patch; removing the unused artifact is the resolution.)
Upgrade notes
Drop-in security update for 1.5.0 — no behavioral changes.
Full Changelog: https://github.com/apache/pinot/compare/release-1.5.0...release-1.5.1