Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-59060 EUVD-2025-208229GHSA-5fvg-qwcp-r325

Apache Ranger: Hostname verification bypass in NiFiRegistryClient

Published Mar 3, 2026 · Updated Aug 24, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Ranger Package: org.apache.ranger:ranger-nifi-registry-plugin Ecosystem: Maven

Description

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Ranger ≤ 2.7.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.ranger:ranger-nifi-registry-plugin < 2.8.0 2.8.0 GHSA-5fvg-qwcp-r325

References