Login Request a demo
AH
Product
Apache Hive
by Apache Software Foundation · last CVE Aug 25, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 2High 2Medium 5Low 0
Severity
All severities9Critical2High2Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Hive to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49845
9.8
1%
Aug 25
Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
Affected: 4.0.0 through 4.2.0
CVE-2026-55976
9.1
1%
Aug 25
Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
Affected: 2.1.0 through 4.2.0
CVE-2022-41137
8.3
2%
Dec 5
Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Affected: 4.0.0-alpha-1 before 4.0.0
CVE-2026-53561
7.4
0%
Aug 25
Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user
Affected: 4.0.0 through 4.2.0
CVE-2023-35701
6.6
1%
May 3
Apache Hive: Arbitrary command execution via JDBC driver
Affected: 4.0.0-alpha-1 before 4.0.0
CVE-2024-23953
6.5
1%
Jan 28
Apache Hive: Timing Attack Against Signature in LLAP util
Affected: 2.2.0 before 4.0.0
CVE-2024-23945
5.9
2%
Dec 23
Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails
Affected: 1.2.0 before 4.0.0
CVE-2024-29869
5.5
0%
Jan 28
Apache Hive: Credentials file created with non restrictive permissions
Affected: 1.1.0 before 4.0.1
CVE-2025-62728
5.4
0%
Nov 26
Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs
Affected: 4.1.0 before 4.2.0
Showing 9