Apache Hive vulnerabilities

• apache hive Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVE-2026-49845 9.8 CriticalAugust 25, 2026
• apache hive Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVE-2026-55976 9.1 CriticalAugust 25, 2026
• apache hive Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user CVE-2026-53561 7.4 HighAugust 25, 2026
• apache hive Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs CVE-2025-62728 Fix available 5.4 MediumNovember 26, 2025
• apache hive Apache Hive: Credentials file created with non restrictive permissions CVE-2024-29869 Fix available 5.5 MediumJanuary 28, 2025
• apache hive Apache Hive: Timing Attack Against Signature in LLAP util CVE-2024-23953 Fix available 6.5 MediumJanuary 28, 2025
• apache hive, spark +1 more Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails CVE-2024-23945 Fix available 5.9 MediumDecember 23, 2024
• apache hive Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore CVE-2022-41137 Fix available 8.3 HighDecember 5, 2024
• apache hive Apache Hive: Arbitrary command execution via JDBC driver CVE-2023-35701 Fix available 6.6 MediumMay 3, 2024
• apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user CVE-2023-37415 Fix available 8.8 HighJuly 13, 2023
• apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Hive Provider Beeline RCE with Principal CVE-2023-35797 Fix available 9.8 CriticalJuly 3, 2023
• apache airflow hive provider Apache Airflow Hive Provider Beeline Remote Command Execution CVE-2023-28706 Fix available 9.8 CriticalApril 7, 2023
• apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Hive Provider Beeline RCE CVE-2023-25696 Fix available 9.8 CriticalFebruary 24, 2023
• apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 more Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params CVE-2022-46421 Fix available 9.8 CriticalDecember 20, 2022
• apache airflow, apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +2 more Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection) CVE-2022-41131 Fix available 7.8 HighNovember 22, 2022
• apache hive Apache Hive Security vulnerability in Hive with UDFs CVE-2021-34538 Fix available 7.5 HighJuly 16, 2022
• apache hive Timing attack in Cookie signature verification CVE-2020-1926 Fix available 5.9 MediumMarch 16, 2021
• apache thrift, hive, oracle communications cloud native core network slice selection function +1 more +3 more Uncontrolled Resource Consumption in Apache Thrift CVE-2020-13949 Fix available 7.5 HighFebruary 12, 2021
• jodd, apache hive +1 more Deserialization of Untrusted Data in Jodd CVE-2018-21234 Fix available 9.8 CriticalMay 21, 2020
• apache hive Moderate severity vulnerability that affects org.apache.hive:hive-jdbc CVE-2018-1314 Fix available 4.3 MediumNovember 8, 2018
• apache hive Improper Authentication in hive:hive-exec CVE-2018-11777 Fix available 8.1 HighNovember 8, 2018
• apache hive Incorrect Permission Assignment for Critical Resource in Apache hive CVE-2018-1315 Fix available 3.7 LowApril 5, 2018
• apache hive Exposure of Sensitive Information to an Unauthorized Actor in Apache hive CVE-2018-1284 Fix available 3.7 LowApril 5, 2018
• apache hive SQL Injection in hive-jdbc CVE-2018-1282 Fix available 9.1 CriticalApril 5, 2018
• apache hive Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2017-12625 Fix available 4.3 MediumNovember 1, 2017
• apache hive org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation CVE-2016-3083 Fix available 7.5 HighMay 30, 2017
• apache hive High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2015-7521 Fix available 8.3 HighJanuary 29, 2016
• apache hive, ibm infosphere biginsights +1 more Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service CVE-2015-1772 Fix available 7.3 HighDecember 21, 2015
• apache hive Low severity vulnerability that affects org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service CVE-2014-0228 Fix available 3.5 LowNovember 16, 2014