# Security vulnerabilities in Dremio 25.X

**URL:** <https://community.dremio.com/t/security-vulnerabilities-in-dremio-25-x/12073>\
**Category:** Uncategorized\
**Created:** [July 15, 2024, 6:54am UTC](https://community.dremio.com/t/security-vulnerabilities-in-dremio-25-x/12073 "2024-07-15T06:54:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abkul](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@abkul](https://community.dremio.com/u/abkul)\
**Post date:** [July 15, 2024, 6:54am UTC](https://community.dremio.com/t/security-vulnerabilities-in-dremio-25-x/12073/1 "2024-07-15T06:54:01Z")

</div>

Hi Team, In our security scan on Dremio 25.X version, we found vulnerabilities in the following 3rd party jars as they are not updated to latest safe versions.

dremio-twill-shaded  
org.elasticsearch:elasticsearch  
com.google.protobuf:protobuf-java  
org.codehaus.janino:janino  
javax.el-3.0.1-b11  
jetty-http  
jetty-server  
jetty-servlets  
jetty-util  
json-smart  
libthrift  
netty-3.10.6.Final-nohttp  
netty-handler-4.1.68.Final  
parquet-jackson  
pf4j  
postgresql  
woodstox-core  
zookeeper

Can you please let us know if the vulnerabilities are applicable? if yes, any plans to fix them

---

<div class="post-metadata">

**Author:** ![balaji.ramaswamy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/balaji.ramaswamy/32/843_2.png) [@balaji.ramaswamy](https://community.dremio.com/u/balaji.ramaswamy)\
**Post date:** [July 22, 2024, 4:19am UTC](https://community.dremio.com/t/security-vulnerabilities-in-dremio-25-x/12073/2 "2024-07-22T04:19:05Z")

</div>

@abkul

We take security issues seriously here. [Security | Dremio](https://www.dremio.com/platform/security/) has some more information about our approach. In general, we resolve exploitable security issues within our internal security SLAs based on severity while also aiming to update other packages with vulnerabilities (that aren’t exploitable) up to date. We do our best to document package changes in the release notes as well. You can see some of the updates made in 25.0.0 and subsequent releases on the website [here](https://docs.dremio.com/current/release-notes/version-250-release/).