Apache Hadoop vulnerabilities

37 CVEs affecting Apache Hadoop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-27821, published 2026-01-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-17195, published 2019-10-15. Critical severity, CVSS 9.8. EPSS: 11.1% chance of exploitation in the next 30 days. Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential…
CVE-2018-8009, published 2018-11-13. High severity, CVSS 8.8. EPSS: 6.7% chance of exploitation in the next 30 days. Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
CVE-2018-11768, published 2019-10-04. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
CVE-2017-3162, published 2017-04-26. High severity, CVSS 7.3. EPSS: 6.4% chance of exploitation in the next 30 days. HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
CVE-2018-11765, published 2020-09-30. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through…
CVE-2012-1574, published 2012-04-12. Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days. The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera…
CVE-2022-25168, published 2022-08-04. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3…
CVE-2020-9492, published 2021-01-26. High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days. In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
CVE-2022-26612, published 2022-04-07. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected…
CVE-2021-33036, published 2022-06-15. High severity, CVSS 8.8. EPSS: 4% chance of exploitation in the next 30 days. In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should…

Latest

CVE-2025-27821, published 2026-01-26. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the…
CVE-2024-23454, published 2024-09-25. Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days. Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the…
CVE-2023-26031, published 2023-11-16. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote…
CVE-2021-25642, published 2022-08-25. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run…
CVE-2021-37404, published 2022-06-13. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution.…
CVE-2018-11764, published 2020-10-21. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.