What’s Vulnerable › Products

Apache Software Foundation Apache Hive vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Apache Software Foundation Apache Hive version is affected

Latest Apache Software Foundation Apache Hive vulnerabilities

• CVE-2026-55976 — Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url (CVSS 9.1)
• CVE-2026-53561 — Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user (CVSS 7.4)
• CVE-2026-49845 — Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths (CVSS 9.8)
• CVE-2025-62728 — Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs (CVSS 5.4)
• CVE-2024-29869 — Apache Hive: Credentials file created with non restrictive permissions (CVSS 5.5)
• CVE-2024-23953 — Apache Hive: Timing Attack Against Signature in LLAP util (CVSS 6.5)
• CVE-2024-23945 — Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails (CVSS 5.9)
• CVE-2022-41137 — Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore (CVSS 8.3)
• CVE-2023-35701 — Apache Hive: Arbitrary command execution via JDBC driver (CVSS 6.6)
• CVE-2021-34538 — Apache Hive Security vulnerability in Hive with UDFs (CVSS 7.5)
• CVE-2020-1926 — Timing attack in Cookie signature verification (CVSS 5.9)
• CVE-2020-13949 — (CVSS 7.5)
• CVE-2018-21234 — (CVSS 9.8)
• CVE-2018-1314 — (CVSS 4.3)
• CVE-2018-11777 — (CVSS 8.1)
• CVE-2018-1315 — (CVSS 3.7)
• CVE-2018-1284 — (CVSS 3.7)
• CVE-2018-1282 — (CVSS 9.1)
• CVE-2017-12625 — (CVSS 4.3)
• CVE-2016-3083 — (CVSS 7.5)
• CVE-2015-7521 — (CVSS 8.3)
• CVE-2015-1772 — (CVSS 7.3)
• CVE-2014-0228 — (CVSS 3.5)