What’s Vulnerable › Vulnerabilities

CVE-2021-37404: Heap buffer overflow in libhdfs native library

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-787

Description

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

Affected products

• Apache Software Foundation Apache Hadoop: from 2.9.0 before 2.10.2; from 3.0.0 through 3.1.4; from 3.2.0 before 3.2.3; from 3.3.0 before 3.3.2 — fixed in 2.10.2, 3.2.3, 3.3.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Hadoop 2.10.2, 3.2.3, 3.3.2. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo
• https://security.netapp.com/advisory/ntap-20220715-0007/
• https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo
• https://security.netapp.com/advisory/ntap-20220715-0007/

Get alerted when CVE-2021-37404 or the next vulnerability affects your stack