Apache Software Foundation Hive vulnerabilities

• apache hive Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVE-2026-49845 9.8 CriticalAugust 25, 2026
• apache hive Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVE-2026-55976 9.1 CriticalAugust 25, 2026
• apache hive Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user CVE-2026-53561 7.4 HighAugust 25, 2026
• apache hive Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs CVE-2025-62728 Fix available 5.4 MediumNovember 26, 2025
• apache hive Apache Hive: Credentials file created with non restrictive permissions CVE-2024-29869 Fix available 5.5 MediumJanuary 28, 2025
• apache hive Apache Hive: Timing Attack Against Signature in LLAP util CVE-2024-23953 Fix available 6.5 MediumJanuary 28, 2025
• apache hive, spark +1 more Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails CVE-2024-23945 Fix available 5.9 MediumDecember 23, 2024
• apache hive Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore CVE-2022-41137 Fix available 8.3 HighDecember 5, 2024
• apache hive Apache Hive: Arbitrary command execution via JDBC driver CVE-2023-35701 Fix available 6.6 MediumMay 3, 2024
• apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user CVE-2023-37415 Fix available 8.8 HighJuly 13, 2023
• apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Hive Provider Beeline RCE with Principal CVE-2023-35797 Fix available 9.8 CriticalJuly 3, 2023
• apache hive Apache Hive Security vulnerability in Hive with UDFs CVE-2021-34538 Fix available 7.5 HighJuly 16, 2022
• apache hive Timing attack in Cookie signature verification CVE-2020-1926 Fix available 5.9 MediumMarch 16, 2021
• apache hive Moderate severity vulnerability that affects org.apache.hive:hive-jdbc CVE-2018-1314 Fix available 4.3 MediumNovember 8, 2018
• apache hive Improper Authentication in hive:hive-exec CVE-2018-11777 Fix available 8.1 HighNovember 8, 2018
• apache hive Incorrect Permission Assignment for Critical Resource in Apache hive CVE-2018-1315 Fix available 3.7 LowApril 5, 2018
• apache hive Exposure of Sensitive Information to an Unauthorized Actor in Apache hive CVE-2018-1284 Fix available 3.7 LowApril 5, 2018
• apache hive SQL Injection in hive-jdbc CVE-2018-1282 Fix available 9.1 CriticalApril 5, 2018
• apache hive Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2017-12625 Fix available 4.3 MediumNovember 1, 2017
• apache hive org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation CVE-2016-3083 Fix available 7.5 HighMay 30, 2017