GHSA-f8vc-wfc8-hxqh is a high-severity (CVSS 8.8) CWE-863 vulnerability in org.apache.hadoop:hadoop-common. A fix is available for org.apache.hadoop:hadoop-common — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-f8vc-wfc8-hxqh by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 388,997 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
org.apache.hadoop:hadoop-common☕org.apache.hadoop:hadoop-common☕org.apache.hadoop:hadoop-commonReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.hadoop:hadoop-common | ≥ 3.2.0&&< 3.2.2 | 3.2.2org.apache.hadoop:hadoop-common:3.2.2 |
| ☕Maven | org.apache.hadoop:hadoop-common | ≥ 3.0.0&&< 3.1.4 | 3.1.4org.apache.hadoop:hadoop-common:3.1.4 |
| ☕Maven | org.apache.hadoop:hadoop-common | ≥ 2.0.0&&< 2.10.1 | 2.10.1org.apache.hadoop:hadoop-common:2.10.1 |
Affected Products
hadoopapachesolrapachefinancial services crime and compliance management studiooracleDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.hadoop:hadoop-common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.hadoop:hadoop-common to 3.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f8vc-wfc8-hxqh is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
While OpenShift Container Platform (OCP) does package a vulnerable version of hadoop-hdfs-client in the hadoop and hive containers, the HDFS storage back-end is not enabled by default and is largely undocumented/unsupported. However, as it still can be enabled by using the configuration option…
| Product | Fixed in | Advisory |
|---|---|---|
| RHAF Camel-K 1.8 | hadoop-hdfs-client | RHSA-2022:6407 |
| RHINT Camel-Q 2.7 | see advisory | RHSA-2022:5606 |
Frequently Asked Questions
Is GHSA-f8vc-wfc8-hxqh in your dependencies?
Find it across Maven, including transitive dependencies.