Apache Hadoop
18 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Apache Hadoop, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.
Apache Hadoop CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical5
- High9
- Medium4
Latest CVEs
The 15 most recently published vulnerabilities affecting Apache Hadoop.
- CVE-2024-23454Apache Hadoop: Temporary File Local Information Disclosure6.2
- CVE-2023-26031Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems7.5
- CVE-2021-25642Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler8.8
- CVE-2022-25168Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar9.8
- CVE-2021-33036Apache Hadoop Privilege escalation vulnerability8.8
- CVE-2021-37404Heap buffer overflow in libhdfs native library9.8
- CVE-2022-26612Arbitrary file write in FileUtil#unpackEntries on Windows9.8
- CVE-2018-1296In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the ...7.5
- CVE-2018-11766In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.8.8
- CVE-2018-8009Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.8.8
- CVE-2017-15718The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.9.8
- CVE-2017-15713Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduc...6.5
- CVE-2017-3166In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization ...7.8
- CVE-2016-3086The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.9.8
- CVE-2016-5001This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craf...5.5
Product grouping is registry-driven, with AI assist and human review. How it works