Is org.apache.hadoop:hadoop-common safe ? org.apache.hadoop:hadoop-common (maven) has 12 known vulnerabilities, the worst rated CRITICAL. Upgrade to 3.4.0 or later to clear all of them. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 92nd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-8wm5-8h9c-47pc, the advisory selected below
// 12 advisories GHSA-8wm5-8h9c-47pc Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. CRIT GHSA-rmpj-7c96-mrg8 There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. CRIT GHSA-gx2c-fvhc-ph4j In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. CRIT GHSA-h24p-qwf4-84q8 In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. HIGH GHSA-7q56-mp4c-gggg In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with… HIGH GHSA-mf7c-35mq-75pj In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. HIGH GHSA-f8vc-wfc8-hxqh In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without… HIGH GHSA-9r7g-325h-mxrm Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes… MODE GHSA-g48f-ff5h-5f64 Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the… MODE GHSA-8r28-r8cp-g6cp This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. MODE GHSA-f5fw-25gw-5m92 Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. LOW GHSA-pxv5-5vmp-3jj4 The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are… LOW Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High // questions Is org.apache.hadoop:hadoop-common safe to install? CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for org.apache.hadoop:hadoop-common (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.apache.hadoop:hadoop-common have known vulnerabilities? Yes. CyberXYZ records 12 known vulnerabilities for org.apache.hadoop:hadoop-common (maven), the worst rated CRITICAL. These include GHSA-8wm5-8h9c-47pc, GHSA-rmpj-7c96-mrg8, GHSA-gx2c-fvhc-ph4j, GHSA-h24p-qwf4-84q8, GHSA-7q56-mp4c-gggg.
Which version of org.apache.hadoop:hadoop-common should I use? 3.4.0 or later clears every advisory recorded for org.apache.hadoop:hadoop-common (maven). Check the release you pick before installing it.
How do I check org.apache.hadoop:hadoop-common before installing? Search org.apache.hadoop:hadoop-common in CyberXYZ Check at https://cyberxyz.io/check?q=org.apache.hadoop%3Ahadoop-common . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:37 UTC. The most recent advisory here was published 2024-09-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page