Hive (Apache) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 91 known versions, newest CVE from 2026-08-25. Vendor: Apache.

CVEs of Hive

CVE-2026-49845 - CVSS 9.8 (critical), 2026-08-25: SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to…
CVE-2026-55976 - CVSS 9.1 (critical), 2026-08-25: Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE…
CVE-2026-53561 - CVSS 7.4 (high), 2026-08-25: An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on…
CVE-2025-62728 - CVSS 5.4 (medium), 2025-11-26: SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only…
CVE-2024-29869 - CVSS 5.5 (medium), 2025-01-28: Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly.…
CVE-2024-23953 - CVSS 6.5 (medium), 2025-01-28: Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte…
CVE-2024-23945 - CVSS 5.9 (medium), 2024-12-23: Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps…
CVE-2022-41137 - CVSS 8.3 (high), 2024-12-05: Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe…
CVE-2023-35701 - CVSS 6.6 (medium), 2024-05-03: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can…
CVE-2021-34538 - CVSS 7.5 (high), 2022-07-16: Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found…
CVE-2020-1926 - CVSS 5.9 (medium), 2021-03-16: Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of…
CVE-2020-13949 - CVSS 7.5 (high), 2021-02-12: In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to…
CVE-2018-21234 - CVSS 9.8 (critical), 2020-05-21: Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2018-1314 - CVSS 4.3 (medium), 2018-11-08: In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized…
CVE-2018-11777 - CVSS 8.1 (high), 2018-11-08: In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql…
CVE-2018-1284 - CVSS 3.7 (low), 2018-04-05: In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs…
CVE-2018-1315 - CVSS 3.7 (low), 2018-04-05: In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to…
CVE-2018-1282 - CVSS 9.1 (critical), 2018-04-05: This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC…
CVE-2017-12625 - CVSS 4.3 (medium), 2017-11-01: Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or…
CVE-2016-3083 - CVSS 7.5 (high), 2017-05-30: Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's…
CVE-2015-7521 - CVSS 8.3 (high), 2016-01-29: The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows…
CVE-2015-1772 - CVSS 7.3 (high), 2015-12-21: The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and…
CVE-2014-0228 - CVSS 3.5 (low), 2014-11-16: Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export…