High · 7.3 CVE-2025-27821 EUVD-2025-206351GHSA-92cc-952p-v8rh

HDFS native client: Out of bounds write in URI parser of native HDFS client

Published Jan 26, 2026 · Updated Jan 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: HDFS native client Package: org.apache.hadoop:hadoop-hdfs-native-client Ecosystem: Maven

Description

Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client.

This issue affects Apache Hadoop: from 3.2.0 before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	HDFS native client	3.2.0 – < 3.4.2	3.4.2

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.hadoop:hadoop-hdfs-native-client	>= 3.2.0, < 3.4.2	3.4.2	GHSA-92cc-952p-v8rh

Advisories 4

WID-SEC-2026-2433 Oracle NoSQL Database: Schwachstelle gefährdet Vertraulichkeit, Integrität und Verfügbarkeit BSI CERT-Bund (WID) · Jul 21, 2026
WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
WID-SEC-2026-0216 Apache Hadoop HDFS Native Client: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 26, 2026

References

https://lists.apache.org/thread/kwjhyyx0wl2z9b0mw0styjk0hhdbyplh vendor-advisory