Apache Hadoop vulnerabilities

• apache hadoop, apache software foundation hdfs native client +1 more HDFS native client: Out of bounds write in URI parser of native HDFS client CVE-2025-27821 Fix available 7.3 HighJanuary 26, 2026
• apache hadoop Apache Hadoop: Temporary File Local Information Disclosure CVE-2024-23454 Fix available 6.2 MediumSeptember 25, 2024
• apache hadoop Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems CVE-2023-26031 Fix available 7.5 HighNovember 16, 2023
• apache hadoop Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler CVE-2021-25642 Public exploitFix available 8.8 HighAugust 25, 2022
• apache hadoop Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVE-2022-25168 Fix available 9.8 CriticalAugust 4, 2022
• apache hadoop Apache Hadoop Privilege escalation vulnerability CVE-2021-33036 Fix available 8.8 HighJune 15, 2022
• apache hadoop Heap buffer overflow in libhdfs native library CVE-2021-37404 Fix available 9.8 CriticalJune 13, 2022
• apache hadoop Arbitrary file write in FileUtil#unpackEntries on Windows CVE-2022-26612 Fix available 9.8 CriticalApril 7, 2022
• apache hadoop, solr, oracle financial services crime and compliance management studio +2 more Improper Privilege Management in Apache Hadoop CVE-2020-9492 Fix available 8.8 HighJanuary 26, 2021
• apache hadoop Authentication bypass in Apache Hadoop CVE-2018-11764 Fix available 8.8 HighOctober 21, 2020
• apache hadoop Improper Authentication in Apache Hadoop CVE-2018-11765 Fix available 7.5 HighSeptember 30, 2020
• apache hadoop Hadoop symlink vulnerability CVE-2012-2945 Fix available 7.5 HighOctober 28, 2019
• apache hadoop, connect2id nimbus jose\+jwt, oracle communications cloud native core security edge protection proxy +12 more +14 more Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT CVE-2019-17195 Public exploitFix available EPSS 11.1% 9.8 CriticalOctober 15, 2019
• apache hadoop user/group information can be corrupted across storing in fsimage and reading back from fsimage CVE-2018-11768 Fix available 7.5 HighOctober 4, 2019
• apache hadoop Privilege escalation vulnerability in Apache Hadoop CVE-2018-8029 Fix available 8.8 HighMay 30, 2019
• apache hadoop Improper Privilege Management in org.apache.hadoop:hadoop-main CVE-2018-11767 Fix available 7.4 HighMarch 18, 2019
• apache hadoop Exposure of Sensitive Information to an Unauthorized Actor in Hadoop CVE-2018-1296 Fix available 7.5 HighFebruary 7, 2019
• apache hadoop Arbitrary Command Execution in Hadoop CVE-2018-11766 Fix available 8.8 HighNovember 27, 2018
• apache hadoop Path Traversal in Hadoop CVE-2018-8009 Fix available 8.8 HighNovember 13, 2018
• apache hadoop Exposure of Sensitive Information in Hadoop CVE-2017-15718 Fix available 9.8 CriticalJanuary 24, 2018
• apache hadoop Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main CVE-2017-15713 Fix available 6.5 MediumJanuary 19, 2018
• apache hadoop Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main CVE-2017-3166 Fix available 7.8 HighNovember 13, 2017
• apache hadoop Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop CVE-2012-4449 Fix available 9.8 CriticalOctober 30, 2017
• apache hadoop Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop CVE-2016-3086 Fix available 9.8 CriticalSeptember 5, 2017
• apache hadoop Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop CVE-2016-5001 Fix available 5.5 MediumAugust 30, 2017
• apache hadoop Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation CVE-2017-7669 Fix available 7.5 HighJune 2, 2017
• apache hadoop Improper Input Validation in Apache Hadoop CVE-2017-3162 Fix available 7.3 HighApril 26, 2017
• apache hadoop Improper Neutralization of Input During Web Page Generation in Apache Hadoop CVE-2017-3161 Fix available 6.1 MediumApril 26, 2017
• apache hadoop Insecure Inherited Permissions in Apache Hadoop CVE-2016-6811 Fix available 8.8 HighApril 11, 2017
• apache hadoop, cloudera cdh +1 more Improper Authentication in Apache Hadoop CVE-2014-0229 Fix available 6.5 MediumMarch 23, 2017
• apache hadoop Improper Access Control in Apache Hadoop CVE-2016-5393 Fix available 8.8 HighNovember 29, 2016
• apache hadoop Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop CVE-2015-1776 Fix available 6.2 MediumApril 19, 2016
• apache hadoop The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and... CVE-2015-7430 8.4 HighJanuary 2, 2016
• apache hadoop Improper Link Resolution Before File Access in Apache Hadoop CVE-2014-3627 Fix available 5.0 MediumDecember 5, 2014
• apache hadoop Improper Authentication in Apache Hadoop CVE-2013-2192 Fix available 3.2 LowJanuary 24, 2014
• apache hadoop Client BlockTokens not checked in Apache Hadoop CVE-2012-3376 Fix available 7.5 HighJuly 12, 2012
• apache hadoop, cloudera cdh +1 more Apache Hadoop allows impersonation of arbitrary cluster user accounts CVE-2012-1574 Fix available 6.5 MediumApril 12, 2012