Hbase

This hub aggregates every CVE we track for Hbase, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 6 most recently published vulnerabilities affecting Hbase.

• CVE-2026-49326Apache HBase: Missing scanner instance owner check in thrift delegation service6.5Jul 24, 2026
• CVE-2019-15544An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.7.5Aug 26, 2019
• CVE-2019-0212In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were...7.5Mar 28, 2019
• CVE-2018-8025CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being i...8.1Jun 27, 2018
• CVE-2015-1836Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper...7.3Dec 21, 2015
• CVE-2013-2193Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive i...4.3May 29, 2014