CVE-2020-9492: Apache Hadoop

High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days.

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.

Affected products

• Apache Hadoop: from 2.0.0, up to and including 2.10.0; from 3.0.0, up to and including 3.1.3; from 3.2.0, up to and including 3.2.1
• Apache Solr: version 8.6.0 only; version 8.6.2 only
• Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only

Published 2021-01-26. Last modified 2026-06-17.