Apache Pinot Releases

Latest: Apache Pinot 1.5.1 · 30 Jun 2026 - Apache Pinot 1.5.1 Apache Pinot 1.5.1 is a security patch release based on 1.5.0. It contains only dependency updates and dependency-exclusion changes to resolve reported CVEs — no functional, API, configuration, or wire-format changes . A vulnerability scan of the 1.5.1 binary distribution reports 0 critical and 0 high findings. This addresses the CVEs reported in #18593 , plus additional Jetty, BouncyCastle, and commons-configuration2 findings surfaced during release verification. Security fixes Dependency 1.5.0 → 1.5.1 CVEs addressed Netty ( netty-bom ) 4.1.122.Final → 4.1.134.Final CVE-2025-55163 , CVE-2025-59419 , CVE-2026-33870 , CVE-2026-33871 , CVE-2026-42579 , CVE-2026-42583 , CVE-2026-42584 , CVE-2026-42587 Apache Log4j Core 2.25.3 → 2.26.0 CVE-2026-34478 , CVE-2026-34479 , CVE-2026-34480 , CVE-2026-34481 async-http-client 3.0.7 → 3.0.10 CVE-2026-45300 Apache HttpClient 5 5.6 → 5.6.1 CVE-2026-40542 Apache Pulsar (bundles BouncyCastle) 4.0.9 → 4.0.10 (bcprov/bcpkix/bcutil → 1.84 ) CVE-2026-5598 , CVE-2026-0636 , CVE-2026-5588 commons-configuration2 2.13.0 → 2.15.0 CVE-2026-45205 CVE-2026-2332 (Jetty request smuggling) The only Jetty in Pinot's distribution was Hadoop's embedded HttpServer2 , which Pinot never starts. As of 1.5.1 it is excluded from the Hadoop dependencies and stripped from the shaded jars ( #18659 ), so Jetty no longer ships in the distribution at all. (Jetty 9.4.x itself is end-of-life with no available patch; removing the unused artifact is the resolution.) Upgrade notes Drop-in security update for 1.5.0 — no behavioral changes. Full Changelog : release-1.5.0...release-1.5.1