Apache Hive (Apache Software Foundation) - vulnerabilities (CVEs)
18 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2026-08-25. Vendor: Apache Software Foundation.
CVEs of Apache Hive
- CVE-2026-49845 - CVSS 9.8 (critical), 2026-08-25: SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to…
- CVE-2026-55976 - CVSS 9.1 (critical), 2026-08-25: Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE…
- CVE-2026-53561 - CVSS 7.4 (high), 2026-08-25: An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on…
- CVE-2025-62728 - CVSS 5.4 (medium), 2025-11-26: SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only…
- CVE-2024-29869 - CVSS 5.5 (medium), 2025-01-28: Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly.…
- CVE-2024-23953 - CVSS 6.5 (medium), 2025-01-28: Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte…
- CVE-2024-23945 - CVSS 5.9 (medium), 2024-12-23: Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps…
- CVE-2022-41137 - CVSS 8.3 (high), 2024-12-05: Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe…
- CVE-2023-35701 - CVSS 6.6 (medium), 2024-05-03: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can…
- CVE-2021-34538 - CVSS 7.5 (high), 2022-07-16: Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found…
- CVE-2020-1926 - CVSS 5.9 (medium), 2021-03-16: Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of…
- CVE-2018-1314 - CVSS 4.3 (medium), 2018-11-08: In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized…
- CVE-2018-11777 - CVSS 8.1 (high), 2018-11-08: In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql…
- CVE-2018-1315 - CVSS 3.7 (low), 2018-04-05: In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to…
- CVE-2018-1284 - CVSS 3.7 (low), 2018-04-05: In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs…
- CVE-2018-1282 - CVSS 9.1 (critical), 2018-04-05: This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC…
- CVE-2017-12625 - CVSS 4.3 (medium), 2017-11-01: Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or…
- CVE-2016-3083 - CVSS 7.5 (high), 2017-05-30: Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's…
