Apache Software Foundation Apache Hive

• CVE-2026-49845 Critical 9.8 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths 0.9%
• CVE-2026-55976 Critical 9.1 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url 1.0%
• CVE-2026-53561 High 7.4 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user 0.3%
• CVE-2025-62728 Medium 5.4 Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs 0.4%
• CVE-2024-29869 Medium 5.5 Apache Hive: Credentials file created with non restrictive permissions 0.3%
• CVE-2024-23953 Medium 6.5 Apache Hive: Timing Attack Against Signature in LLAP util 1.4%
• CVE-2024-23945 Medium 5.9 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails 1.6%
• CVE-2022-41137 High 8.3 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore 1.6%
• CVE-2023-35701 Medium 6.6 Apache Hive: Arbitrary command execution via JDBC driver 1.1%
• CVE-2021-34538 Unrated Apache Hive Security vulnerability in Hive with UDFs 1.9%
• CVE-2020-1926 Unrated Timing attack in Cookie signature verification 2.5%