CVE-2021-37404

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-37404
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37404.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-37404
Aliases
Downstream
CGA (4)
OESA (1)
Published
2022-06-13T07:15:08Z
Modified
2026-07-08T22:13:41Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

References

Affected packages

Git / github.com/apache/hadoop

Affected ranges

Type
GIT
Repo
https://github.com/apache/hadoop
Events
Introduced
756ebc8394e473ac25feac05fa493f6d612e6c50
Fixed
965fd380006fa78b2315668fbc7eb432e1d8200f
Introduced
c25427ceca461ee979d30edd7a4b0f50718e6533
Last Affected
1e877761e8dadd71effef30e592368f7fe66a61b
Introduced
e97acb3bd8f3befd27418996fa5d4b50bf2e17bf
Fixed
abe5358143720085498613d399be3bbf01e0f131
Introduced
aa96f1871bfd858f9bac59cf2a81ec470da649af
Fixed
0bcb014209e219273cb6fd4152df7df713cbac61
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.9.0"
        },
        {
            "fixed":  "2.10.2"
        },
        {
            "introduced":  "3.0.0"
        },
        {
            "last_affected":  "3.1.4"
        },
        {
            "introduced":  "3.2.0"
        },
        {
            "fixed":  "3.2.3"
        },
        {
            "introduced":  "3.3.0"
        },
        {
            "fixed":  "3.3.2"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37404.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "172508901140850166315077168976677568660",
            "length":  705
        },
        "id":  "CVE-2021-37404-cf0079d5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/hadoop/commit/abe5358143720085498613d399be3bbf01e0f131",
        "target":  {
            "file":  "hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/conf/Configuration.java",
            "function":  "getTimeDurationHelper"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "117241420199337029436298470313516342337",
                "10911464053357943410825609861845695837",
                "240437666491262468440316638114074933731",
                "226622566833744400926285549106341911654",
                "249375286985992668764075164756526076674"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-37404-f2b0819d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/hadoop/commit/abe5358143720085498613d399be3bbf01e0f131",
        "target":  {
            "file":  "hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/conf/Configuration.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-08T22:13:41Z"