Apache hive

This hub aggregates every CVE we track for Apache hive, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache hive.

• CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths9.8Aug 25, 2026
• CVE-2026-55976Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url9.1Aug 25, 2026
• CVE-2026-53561Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user7.4Aug 25, 2026
• CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs5.4Nov 26, 2025
• CVE-2024-29869Apache Hive: Credentials file created with non restrictive permissions5.5Jan 28, 2025
• CVE-2024-23953Apache Hive: Timing Attack Against Signature in LLAP util6.5Jan 28, 2025
• CVE-2024-23945Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails5.9Dec 23, 2024
• CVE-2022-41137Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore8.3Dec 5, 2024
• CVE-2023-35701Apache Hive: Arbitrary command execution via JDBC driver6.6May 3, 2024
• CVE-2021-34538Apache Hive Security vulnerability in Hive with UDFs7.5Jul 16, 2022
• CVE-2020-1926Timing attack in Cookie signature verification5.9Mar 16, 2021
• CVE-2018-11777In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.8.1Nov 8, 2018
• CVE-2018-1314In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary tabl...4.3Nov 8, 2018
• CVE-2018-1282This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement impleme...9.1Apr 5, 2018
• CVE-2018-1315In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on...3.7Apr 5, 2018