Apache Hadoop vulnerabilities
36 known vulnerabilities affecting apache/hadoop.
Total CVEs
36
CISA KEV
0
Public exploits
0
Exploited in wild
1
Severity breakdown
CRITICAL7HIGH20MEDIUM8LOW1
Vulnerabilities
Page 1 of 2
CVE-2017-15718P2CRITICALCVSS 9.8Exploitedv2.7.3v2.7.42018-01-24
CVE-2017-15718 [CRITICAL] CVE-2017-15718: The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store pro
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
nvd
CVE-2022-25168P2CRITICALCVSS 9.8≥ 2.0.0, ≤ 2.10.1≥ 3.0.0, ≤ 3.2.3+1 more2022-08-04
CVE-2022-25168 [CRITICAL] CWE-78 CVE-2022-25168: Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being pass
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable re
nvd
CVE-2021-33036P2HIGHCVSS 8.8≥ 2.2.0, < 2.10.2≥ 3.0.1, < 3.2.3+2 more2022-06-15
CVE-2021-33036 [HIGH] CWE-24 CVE-2021-33036: In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
nvd
CVE-2018-8029P3HIGHCVSS 8.8≥ 2.2.0, ≤ 2.8.4≥ 3.0.1, ≤ 3.1.0+3 more2019-05-30
CVE-2018-8029 [HIGH] CVE-2018-8029: In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
nvd
CVE-2021-25642P3HIGHCVSS 8.8≥ 2.9.0, < 2.10.2≥ 3.0.0, < 3.2.4+1 more2022-08-25
CVE-2021-25642 [HIGH] CWE-502 CVE-2021-25642: ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserialize
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfig
nvd
CVE-2020-9492P3HIGHCVSS 8.8≥ 2.0.0, ≤ 2.10.0≥ 3.0.0, ≤ 3.1.3+1 more2021-01-26
CVE-2020-9492 [HIGH] CWE-863 CVE-2020-9492: In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client mi
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
nvd
CVE-2022-26612P3CRITICALCVSS 9.8fixed in 3.2.3v3.3.1+1 more2022-04-07
CVE-2022-26612 [CRITICAL] CWE-59 CVE-2022-26612: In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar ut
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the syml
nvd
CVE-2021-37404P3CRITICALCVSS 9.8≥ 2.9.0, < 2.10.2≥ 3.0.0, ≤ 3.1.4+2 more2022-06-13
CVE-2021-37404 [CRITICAL] CWE-787 CVE-2021-37404: There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
nvd
CVE-2016-5393P3HIGHCVSS 8.8v2.7.0v2.7.1+6 more2016-11-29
CVE-2016-5393 [HIGH] CWE-284 CVE-2016-5393: In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
nvd
CVE-2016-6811P3HIGHCVSS 8.8≥ 2.2.0, ≤ 2.7.32017-04-11
CVE-2016-6811 [HIGH] CWE-264 CVE-2016-6811: In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary c
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
nvd
CVE-2019-17195P3CRITICALCVSS 9.8v3.2.12019-10-15
CVE-2019-17195 [CRITICAL] CWE-755 CVE-2019-17195: Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, wh
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
nvd
CVE-2018-11766P3HIGHCVSS 8.8≥ 2.7.4, ≤ 2.7.62018-11-27
CVE-2018-11766 [HIGH] CVE-2018-11766: In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can es
In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
nvd
CVE-2018-11764P3HIGHCVSS 8.8v3.0.02020-10-21
CVE-2018-11764 [HIGH] CWE-306 CVE-2018-11764: Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. A
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
nvd
CVE-2018-11765P3HIGHCVSS 7.5≥ 2.8.0, ≤ 2.8.5≥ 2.9.0, ≤ 2.9.2+1 more2020-09-30
CVE-2018-11765 [HIGH] CWE-287 CVE-2018-11765: In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can acces
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
nvd
CVE-2018-8009P3HIGHCVSS 8.8≥ 0.23.0, ≤ 0.23.11≥ 2.0.0, ≤ 2.7.6+10 more2018-11-13
CVE-2018-8009 [HIGH] CWE-22 CVE-2018-8009: Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.2
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
nvd
CVE-2023-26031P3HIGHCVSS 7.5≥ 3.3.1, ≤ 3.3.42023-11-16
CVE-2023-26031 [HIGH] CWE-426 CVE-2023-26031: Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux
Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.
Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/
nvd
CVE-2016-3086P3CRITICALCVSS 9.8v2.6.0v2.6.1+6 more2017-09-05
CVE-2016-3086 [CRITICAL] CWE-200 CVE-2016-3086: The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the passwor
The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
nvd
CVE-2025-27821P3HIGHCVSS 7.3≥ 3.2.0, < 3.4.22026-01-26
CVE-2025-27821 [HIGH] CWE-787 CVE-2025-27821: Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Ha
Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client.
This issue affects Apache Hadoop: from 3.2.0 before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
nvd
CVE-2017-7669P3HIGHCVSS 7.5v2.8.0v3.0.02017-06-05
CVE-2017-7669 [HIGH] CWE-20 CVE-2017-7669: In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker comma
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
nvd
CVE-2018-11767P3HIGHCVSS 7.4≥ 2.7.5, ≤ 2.7.6≥ 2.8.3, ≤ 2.8.4+1 more2019-03-21
CVE-2018-11767 [HIGH] CWE-269 CVE-2018-11767: In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting acce
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
nvd
1 / 2Next →