CVE-2025-59059
Critical · 9.8CVSS
9.8
EPSS
1.3%
Published
Mar 3, 2026
CISA due date
—
The record
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.ranger:ranger-plugins-common | 0 | 2.8.0 |
| Chainguard | druid | 0 | 36.0.0-r3 |
| Chainguard | trino-plugin-ranger | 0 | 480-r0 |
| Wolfi | druid | 0 | 36.0.0-r3 |
| Wolfi | trino-plugin-ranger | 0 | 480-r0 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects druid
- CVE-2026-33870 Netty is an asynchronous, event-driven network application framework. Also affects druid
- CVE-2026-24308 Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4… Also affects druid
- CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a… Also affects druid
- CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro… Also affects druid
- CVE-2026-1002 The Vert.x Web static handler component cache can be manipulated to deny the access to… Also affects druid
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects druid
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects druid