CVE-2021-37404: Apache Hadoop heap overflow in libhdfs
Summary
CVE-2021-37404: Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2. Affects org.apache.hadoop:hadoop-common across 3 version ranges.
< 2.10.2
>= 3.0.0, < 3.2.3
>= 3.3.0, < 3.3.2
Fixed in 2.10.2, 3.2.3 or 3.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source framework used for distributed storage and processing of large datasets. The 'org.apache.hadoop:hadoop-common' package is a core component of Apache Hadoop, providing common utilities and libraries. This package is vulnerable to a heap buffer overflow in the libhdfs native code.
Vulnerability Detail
The vulnerability arises from the lack of validation when opening a file path provided by the user. This can lead to a heap buffer overflow, potentially resulting in a denial of service or arbitrary code execution. The issue affects versions prior to 2.10.2, 3.2.3, and 3.3.2 of Apache Hadoop.
How To Fix
Latest published version: 3.5.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.10.22.10.2 -
>= 3.0.0, < 3.2.33.2.3 -
>= 3.3.0, < 3.3.23.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround available for this vulnerability.
Conclusion
The Apache Hadoop 'org.apache.hadoop:hadoop-common' package is vulnerable to a heap buffer overflow in the libhdfs native code. Users should upgrade to the recommended versions to mitigate the risk of a denial of service or arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-common →
FAQ
The vulnerability can potentially lead to a denial of service or arbitrary code execution.
Versions prior to 2.10.2, 3.2.3, and 3.3.2 are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability.
No, there is no known workaround available for this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database at the following source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-rmpj-7c96-mrg8/GHSA-rmpj-7c96-mrg8.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-common.
