625 matches found
CVE-2026-49845
A flaw was found in Apache Hive Metastore. Authenticated users with access to Hive Metastore APIs can exploit a SQL injection vulnerability by submitting crafted partition names in metastore Remote Procedure Call RPC requests when direct SQL is enabled. This allows them to read, modify, or affect...
CLEANSTART-2026-DU01879 Uncontrolled Resource Consumption vulnerability in Apache Commons IO
Security vulnerability affects the apache-hive package. Uncontrolled Resource Consumption vulnerability in Apache Commons IO...
CLEANSTART-2026-NT26909 Security fix for GHSA-47qp-hqvx-6r3f applied in: apache-zookeeper 3.8.6-r4, apache-hive 4.0.1-r7, apache-zookeeper 3.9.5-r4
GHSA-47qp-hqvx-6r3f affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-FR00858 Security fix for GHSA-2r2c-cx56-8933 applied in: apache-zookeeper 3.8.6-r4, apache-hive 4.0.1-r7, apache-zookeeper 3.9.5-r4
GHSA-2r2c-cx56-8933 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-PC80984 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name
Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
CLEANSTART-2026-GG04244 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-IS03783 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active
Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...
CLEANSTART-2026-LX06010 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack
Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...
CLEANSTART-2026-UX67962 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...
Security vulnerability affects the apache-hive package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...
CLEANSTART-2026-KK27304 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-WO74839 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-QA29545 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CLEANSTART-2026-DI06690 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments
Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...
CLEANSTART-2026-NZ58267 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-ET24828 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-WI22978 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...
Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...
CLEANSTART-2026-GC11781 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
CLEANSTART-2026-BT54574 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...
Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...
CLEANSTART-2026-JJ87004 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
CLEANSTART-2026-RH98857 PAC4J is vulnerable to LDAP Injection in multiple methods
Security vulnerability affects the apache-hive package. PAC4J is vulnerable to LDAP Injection in multiple methods...