Security advisories #

Security advisories are necessary to inform you of the impact of publicly disclosed vulnerabilities, exposures, and other reported security threats. These reports are often available as Common Vulnerability and Exposure (CVE), as entries in the National Vulnerability Database, or from other sources.

The following sections provide information for various of the reports based on their unique identifiers. Reports not listed typically do not apply. Contact us for further information about any reports.

Reports are sorted by date, starting with the latest advisories, and aim to cover details for all Starburst products, including Starburst Enterprise platform (SEP) and Starburst Galaxy and included components.

CVE-2026-111497 Brotli decoder remote code execution #

Summary #

Starburst Galaxy: No action is required. Starburst blocked Brotli-encoded HTTP requests across the Starburst Galaxy fleet and rolled out a fully patched release.

Starburst Enterprise platform (SEP): The practical risk is limited. Exploitation requires sending crafted compressed requests to the coordinator’s HTTP endpoint, and the query engine isn’t affected. The fix is available in versions 482-e.6, 480-e.13, 479-e.20, and 477-e.24. Upgrade as part of your normal patching, and upgrade sooner if any coordinator is reachable from untrusted networks.

Details #

CVE-2026-111497 (“HTTP2Shell” / “Node2Shell”) is a critical vulnerability in versions 1.0.3 through 1.2.0 of the Google Brotli C decompression library, disclosed in October

1. A crafted Brotli payload triggers an out-of-bounds write in any software that decodes attacker-controlled Brotli data. The result can be a crash, memory disclosure, or remote code execution. Many downstream projects bundle the library, including Node.js, Envoy, Istio, and brotli4j, which Eclipse Jetty uses.

Starburst impact: Starburst released a fix for the affected product lines. No customer-impacting incident or evidence of exploitation has been observed. Trino query processing isn’t affected. Exposure is limited to HTTP server components that accept compressed request bodies.

Starburst Galaxy: Starburst blocked Brotli-encoded requests (Content-Encoding: br) across the fleet with no impact on normal client, driver, or browser traffic, and rolled out a fully patched release. No action is required.

Starburst Enterprise platform (SEP): The embedded Eclipse Jetty server includes the affected brotli4j library. The fix is included in versions 482-e.6, 480-e.13, 479-e.20, and 477-e.24. Upgrade as part of your normal patching, and upgrade sooner if any coordinator is reachable from untrusted networks.

For questions, contact Starburst Support or your Account Executive.

CVE-2026-109618 and CVE-2026-109619 PHP remote code execution (“PHP2Shell”) #

Summary #

Starburst isn’t affected. No Starburst product or service ships or runs PHP, so there is no customer exposure and no action is required.

Details #

On October 21, 2026, the PHP project disclosed two critical flaws, CVE-2026-109618 and CVE-2026-109619, and released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix them.

• CVE-2026-109618 allows remote code execution through out-of-memory corruption during request cleanup.
• CVE-2026-109619 allows remote code execution through stale request-owned global state that a later request on the same worker reuses.

Both are use-after-free (CWE-416) issues with a CVSS v4.0 score of 9.2 (Critical). They’re exploitable before authentication against common PHP deployments such as PHP-FPM.

Starburst impact: Starburst confirmed that SEP and Starburst Galaxy don’t include, bundle, or run PHP in any component. The vulnerable code path isn’t present, so no mitigation or upgrade is required.

For questions, contact Starburst Support or your Account Executive.

CVE-2026-31431 Linux kernel local privilege escalation #

CVE-2026-31431 (“Copy Fail”) is a high-severity Linux kernel vulnerability publicly disclosed on April 29, 2026.

The flaw allows a local unprivileged user to escalate privileges to root. It affects most Linux distributions and kernel versions released since 2017.

Starburst is aware of this issue, has assessed our products, and has completed remediation. No customer-impacting incident has been observed. This vulnerability requires an attacker to already have local access.

Starburst Galaxy: All Starburst Galaxy clusters now run patched upstream Linux kernels, and Starburst lifted the temporary mitigation that disabled the affected kernel subsystem. No action is required.

Starburst Enterprise platform (SEP): The vulnerability is in the Linux kernel of the host operating system, not in SEP. Major Linux distributions, such as Red Hat, Amazon, Ubuntu, SUSE, and Oracle, now provide patched kernels. Apply the OS patch to your host machines. If you applied the interim algif_aead mitigation, you can remove it after patching.

Starburst rebuilt SEP container base images on patched kernels. The rebuild doesn’t replace patching your host.

For questions, contact Starburst Support or your Account Executive.

CVE-2026-34214 Sensitive configuration information disclosure #

Starburst was notified by an external source of an issue affecting environments where iceberg.catalog.type is set to rest in the Iceberg connector. The issue resulted in catalog storage credentials being exposed in clear text in metadata associated with UPDATE, INSERT, DELETE, MERGE, and CREATE TABLE AS queries. The same credentials were also exposed when a user with the sysadmin role ran Run & Troubleshoot for a query, which prompts a metadata download.

Cloud storage credentials such as AWS access and secret keys could be propagated via internal connector properties and inadvertently included in serialized query metadata. Credentials were exposed for a window of time defined by query.min-expire-age, which defaults to 15 minutes, and query.max-history.

CVE-2026-34214 is remediated in versions 479-e.2, 477-e.8, 476-e.16, and 474-e.20. Customers are strongly advised to upgrade to one of these versions or later.

CVE-2023-38545 and CVE-2023-38546 libcurl #

The CVE-2023-38545 and CVE-2023-38546 reports describe buffer overflow and cookie injection exploits with the libcurl and curl tools. The Starburst engineering team has reviewed these CVEs and confirmed that they do not impact our Starburst Enterprise or Starburst Galaxy products. Out of caution, the Starburst engineering team has updated the library for future releases. Customers do not need to take any action.

Column-level access control bypass #

Starburst has identified a vulnerability impacting SEP version 413-e, allowing column-level access control to be bypassed by use of the use of table functions.

The only vulnerable release of SEP is the short-term support (STS) release of 413-e. The long-term support (LTS) release of 413-e.1 has remediated the issue, customers are strongly advised to upgrade to this version or later.

Please do not hesitate to contact Starburst Support or your Account Executive with any questions or concerns.

HTTP client risk #

Starburst has identified a low-risk vulnerability in which HTTP clients, such as OAuth2, are exposing internal bearer tokens.

The Starburst engineering team conducted an extensive investigation to determine the probability and impact of this exploit. We have patched all LTS releases of SEP, 413-e.1, 407-e.5, 402-e.9, 393-e.14, and 380-e.18, to mitigate this vulnerability.

Starburst urges customers to upgrade your SEP version to the latest version. Change your internal-communication.shared-secret configuration property to a new shared secret (to invalidate potentially leaked tokens).

Please do not hesitate to contact Starburst Support or your Account Executive with any questions or concerns.

CVE-2022-40152 Woodstox #

The CVE-2020-40152 report is related to a potential exploit of the DTD support in the Woodstox XML parser library to facilitate Denial of Service attacks. All affected versions of SEP are being updated to use an updated version of the Woodstox library that removes this vulnerability.

CVE-2022-1471 SnakeYAML #

The CVE-2020-1471 report is related to the Constructor() class of the SnakeYAML library. There is no known exploit in Trino, Starburst Enterprise, or Starburst Galaxy, as these do not use the processor on the executable path. Warp Speed, the Elasticsearch connector, and the Pinot connector are being updated to explicitly exclude SnakeYAML from their dependency trees as a preventative measure.

CVE-2022-3786 and CVE-2022-3602 OpenSSL #

The impact of the OpenSSL high vulnerabilities from CVE-2022-3786 and CVE-2022-3602 on Starburst was analyzed by the engineering and information security teams.

SEP, including the distributed container images, is not vulnerable to any exploits.

The container for the Apache Ranger server with the Starburst Ranger plugin shipped with the Helm chart was updated to include an unaffected version of OpenSSL. The container is used with SEP 401-e, released on the 3 November 2022, and any newer releases, including the 402-e LTS release and backport releases for older LTS versions.

Starburst Galaxy, including the used container images, is not vulnerable to any exploits.

CVE-2022-22947 #

The CVE-2022-22947 report is related to Spring Cloud artifacts and the Gateway Actuator endpoint. They are not in use in Starburst Enterprise, Starburst Galaxy, Apache Ranger or the Hive Metastore Service. It therefore does not apply to any Starburst product.

Spring4Shell #

The Spring4Shell zero day vulnerabilities were identified on the 29 March 2022. They are comprised of the following CVE entries, and the detailed analysis information applies:

CVE-2022-22950 (Spring Framework)

Trino, Starburst Enterprise, and Starburst Galaxy do not use the Spring Framework, and therefore this CVE does not apply.
Hive Metastore Service does not use the Spring Framework, and therefore this CVE does not apply.
No exploit for Apache Ranger is available. No release with the upgrade of the Spring Framework is currently available.

CVE-2022-22963 (Spring Cloud Functions)

Trino, Starburst Enterprise, and Starburst Galaxy do not use Spring Cloud Functions, and therefore this CVE does not apply.
Hive Metastore Service and Apache Ranger do not use Spring Cloud Functions, and therefore this CVE does not apply.

CVE-2022-22965 (Spring MVC, WAR, Tomcat)

Trino, Starburst Enterprise and Starburst Galaxy use Eclipse Jetty, and not Apache Tomcat, and therefore this CVE does not apply.
Hive Metastore Service and Apache Ranger do not use a WAR deployment on Apache Tomcat, and therefore this CVE does not apply.

CVE-2021-42392 #

The CVE-2021-42392 report is related to the H2 database system. Trino and Starburst Enterprise embed H2 binaries only in the legacy Raptor connector plugin. The binaries are only loaded when the plugin is used. This is implemented in a catalog file with connector.name=raptor and is typically not the case. The CVE is therefore not applicable. Concerned users can optionally remove the directory plugin/raptor-legacy in their installation.

CVE-2021-44228 #

Information about CVE-2021-44228 is available in our Security advisory for Log4Shell.

CVE-2021-45046 #

Information about CVE-2021-45046 is available in our Security advisory for Log4Shell.

CVE-2021-45105 #

Information about CVE-2021-45105 is available in our Security advisory for Log4Shell.

CVE-2020-36518 #

The CVE-2020-36518 is related to the databind component of the jackson project from FasterXML. There is no known exploit in Trino, Starburst Enterprise or Starburst Galaxy. The component is updated to the latest, unaffected version 2.13.3, as of airbase 128, and therefore Trino 386, Starburst Enterprise 386-e, and the related Starburst Galaxy update.

The dependencies Phoenix, Calcite and Alluxio include the affected binaries as shaded binaries. No exploits are known, and upgrade to unaffected versions in Trino are pending the release of new upstream versions of each library.