CVE-2025-59060 json
Apache Ranger: Hostname verification bypass in NiFiRegistryClient
published 2026-03-03 8 mo ago modified 2026-08-24 2 mo ago also EUVD-2025-208229 , GHSA-5fvg-qwcp-r325
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Patch / fix
- maven org.apache.ranger:ranger-nifi-registry-plugin 2.8.0
- apache ranger 2.8.0
- org.apache.ranger ranger-nifi-registry-plugin 2.8.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.ranger:ranger-nifi-registry-plugin | <2.8.0 |
2.8.0 |
Affected products
- Apache Software Foundation Apache Ranger
Classification
- Weakness
-
- CWE-297 Improper Validation of Certificate with Host Mismatch
References
-
lists.apache.org
/thread/c4plx81z3xs86vgl3fd95y3q7hhtff05
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/03/02/4
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-59060
advisory
-
github.com
/apache/ranger
package
Sources
- CVE List CVE-2025-59060
- GitHub Advisory GHSA-5fvg-qwcp-r325
- NVD CVE-2025-59060
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.