{"id":"CVE-2021-37404","aliases":["GHSA-rmpj-7c96-mrg8"],"url":"https://o3.security/vulnerability/CVE-2021-37404","summary":"Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2","details":"There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","published":"2022-06-13T07:15:08.327Z","modified":"2026-07-08T22:13:41.387799Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.hadoop:hadoop-common","fixedVersion":"3.3.2"},{"ecosystem":"Maven","name":"org.apache.hadoop:hadoop-common","fixedVersion":"3.2.3"},{"ecosystem":"Maven","name":"org.apache.hadoop:hadoop-common","fixedVersion":"2.10.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220715-0007/"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T22:13:41.387799Z"}}