CVE-2020-13949

CVE-2020-13949 affects Apache Thrift versions 0.9.3 through 0.13.0. The issue: malicious RPC clients can send short messages that trigger extremely large memory allocations, leading to a denial of service. The connected advisories confirm a remote DoS risk in Thrift with impact on servers handlin...

CVE-2021-34538

CVE-2021-34538 affects Apache Hive (before 3.1.3). The vulnerability arises when performing CREATE and DROP operations for UDFs, as authorization checks for involved entities are missing. This could allow an unauthorized user to drop and recreate UDFs and point them to new jars that may be malici...

CVE-2016-3083

CVE-2016-3083 affects Apache Hive JDBC/HiveServer2: SSL is used for plain TCP and HTTP, but the client may fail to verify the certificate’s common name during the SSL handshake in Hive versions before 1.2.2 and 2.0.x before 2.0.1. This can allow a server presenting a valid CA-signed cert for a di...

CVE-2015-1772

CVE-2015-1772 affects HiveServer2 LDAP authentication in Apache Hive (used in IBM InfoSphere BigInsights and similar products). The issue arises when LDAP authentication is configured with simple unauthenticated or anonymous binds, letting remote attackers bypass authentication via crafted LDAP r...

CVE-2026-53561

Apache Hive 4.0.0–4.2.0 contains an improper authentication vulnerability in HiveServer2's SAML bearer-token validation. The flawed code in ThriftHttpServlet.java (doSamlAuth) and HiveSamlAuthTokenGenerator.java accepted attacker-supplied bearer tokens during SAML HTTP authentication without prop...