CVE-2025-27821— HDFS native client: Out of bounds write in URI parser of native HDFS client
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-27821
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HDFS native client: Out of bounds write in URI parser of native HDFS client
Source: NVD (National Vulnerability Database)
Vulnerability Description
Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存写
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Hadoop 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Hadoop是美国Apache基金会的一套开源的分布式系统基础架构。该产品能够对大量数据进行分布式处理，并具有高可靠性、高扩展性、高容错性等特点。ch是ClickHouse开源的一个ClickHouse的低级Go客户端。 Apache Hadoop 3.2.0版本至3.4.2之前版本存在安全漏洞，该漏洞源于HDFS原生客户端存在越界写入，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | HDFS native client | 3.2.0 ~ 3.4.2 | - |
II. Public POCs for CVE-2025-27821
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-27821
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-01-26 · 3 CVEs total
| CVE-2016-15057 | Apache Continuum: Command injection leading to RCE | |
| CVE-2026-24656 | Apache Karaf: Decanter log-socket collector has deserialization vulnerability |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
V. Comments for CVE-2025-27821
No comments yet