Hadoop
37 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Hadoop, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Hadoop CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 37 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High21
- Medium8
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Hadoop.
- CVE-2025-27821HDFS native client: Out of bounds write in URI parser of native HDFS client7.3
- CVE-2024-23454Apache Hadoop: Temporary File Local Information Disclosure6.2
- CVE-2023-26031Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems7.5
- CVE-2021-25642Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler8.8
- CVE-2022-25168Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar9.8
- CVE-2021-33036Apache Hadoop Privilege escalation vulnerability8.8
- CVE-2021-37404Heap buffer overflow in libhdfs native library9.8
- CVE-2022-26612Arbitrary file write in FileUtil#unpackEntries on Windows9.8
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.8.8
- CVE-2018-11764Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.8.8
- CVE-2018-11765In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through...7.5
- CVE-2012-2945Hadoop 1.0.3 contains a symlink vulnerability.7.5
- CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authen...9.8
- CVE-2018-11768In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.7.5
- CVE-2018-8029In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.8.8
Product grouping is registry-driven, with AI assist and human review. How it works