Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability

ALTO 7.3CVE-2025-27821 · GHSA-92cc-952p-v8rh · Published 26/01/2026 · updated 17/06/2026

In breve

CVE-2025-27821 è una vulnerabilità ALTO (CVSS 7.3) che riguarda org.apache.hadoop:hadoop-hdfs-native-client, hadoop (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.91%, superiore al 59.9% delle vulnerabilità.
Correzione: aggiornare a 3.4.2 o successiva.

Package	Affected versions	Patched versions
org.apache.hadoop:hadoop-hdfs-native-client Maven	`≥ 3.2.0, < 3.4.2`	`3.4.2`
hadoop apache	`≥ 3.2.0, < 3.4.2`	`3.4.2`

Description

Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client.

This issue affects Apache Hadoop: from 3.2.0 before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

NVD description

Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2025-27821 · ADVISORY
apache/hadoop#7481 · WEB
apache/hadoop commit 2b32e46 · WEB
apache/hadoop · PACKAGE
issues.apache.org/jira/browse/HDFS-17754 · WEB
lists.apache.org/thread/kwjhyyx0wl2z9b0mw0styjk0hhdbyplh · WEB
openwall.com/lists/oss-security/2026/01/23/7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free