CVE-2025-62728

Apache Hive versions 4.1.0 before 4.2.0 are vulnerable to an SQL injection (CWE-89) in the Hive Metastore Server (HMS) . The flaw occurs when processing delete column statistics requests via Thrift APIs . Exploitation requires trusted/authorized user access to the Thrift APIs and having the metas...