CVE-2021-37404

CRITICAL

Apache Hadoop 2.9.0-2.10.1 and 3.3.0 - Heap Buffer Overflow via Unvalidated File Path

Title source: llm
STIX 2.1

Description

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220715-0007/

Scores

CVSS v3 9.8
EPSS 0.0126
EPSS Percentile 79.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (2)
apache/hadoop 2.9.0 - 2.10.2
org.apache.hadoop/hadoop-common 3.3.0 - 3.3.2Maven
Published Jun 13, 2022
Tracked Since Feb 18, 2026