Memory corruption in Apache Hadoop
Priority MEDIUM 42CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
Why it matters now
EPSS 0.06607 93rd percentileScored 2026-11-07
Fix Partial org.apache.hadoop:hadoop-main (Maven): 2.8.5, 2.9.2, 3.1.1Red Hat: 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Hadoop | Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, 2.0.0-alpha to 2.8.4 | — | No fix listed | CNA |
| — | org.apache.hadoop:hadoop-main (Maven) | 2.2.0 to before 2.8.5 | 2.8.5 | Patch available | GHSA-hx83-rpqf-m267 |
| — | org.apache.hadoop:hadoop-main (Maven) | 2.9.0 to before 2.9.2 | 2.9.2 | Patch available | GHSA-hx83-rpqf-m267 |
| — | org.apache.hadoop:hadoop-main (Maven) | 3.0.0 to before 3.1.1 | 3.1.1 | Patch available | GHSA-hx83-rpqf-m267 |
- Apache Hadoop Vendor— Affected Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, 2.0.0-alpha to 2.8.4 Fixed in — No fix listed CNA
- org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 2.2.0 to before 2.8.5 Fixed in 2.8.5 Patch available GHSA-hx83-rpqf-m267
- org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 2.9.0 to before 2.9.2 Fixed in 2.9.2 Patch available GHSA-hx83-rpqf-m267
- org.apache.hadoop:hadoop-main (Maven) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-hx83-rpqf-m267
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* | 2.2.0 – 2.8.4; 2.9.0 – 2.9.1; 3.0.1 – 3.0.3; 3.1.0 – 3.1.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.0:-:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:* | 2.0.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.1:-:*:*:*:*:*:* | 2.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:* | 2.0.1 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.2:-:*:*:*:*:*:* | 2.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:* | 2.0.2 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.3:-:*:*:*:*:*:* | 2.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:* | 2.0.3 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.4:-:*:*:*:*:*:* | 2.0.4 | Vulnerable | Apache |
- cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.8.4; 2.9.0 – 2.9.1; 3.0.1 – 3.0.3; 3.1.0 – 3.1.1 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.0:-:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.0:alpha:*:*:*:*:*:* Versions 2.0.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.1:-:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.1:alpha:*:*:*:*:*:* Versions 2.0.1 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.2:-:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.2:alpha:*:*:*:*:*:* Versions 2.0.2 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.3:-:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.3:alpha:*:*:*:*:*:* Versions 2.0.3 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.4:-:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Apache
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:* | 2.0.4 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.5:-:*:*:*:*:*:* | 2.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:* | 2.0.5 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.6:-:*:*:*:*:*:* | 2.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.0.6:alpha:*:*:*:*:*:* | 2.0.6 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.1.0:-:*:*:*:*:*:* | 2.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.1.0:beta:*:*:*:*:*:* | 2.1.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:2.1.1:beta:*:*:*:*:*:* | 2.1.1 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:* | 3.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:* | 3.0.0 alpha1 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:* | 3.0.0 alpha2 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:* | 3.0.0 alpha3 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:* | 3.0.0 alpha4 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | Apache |
- cpe:2.3:a:apache:hadoop:2.0.4:alpha:*:*:*:*:*:* Versions 2.0.4 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.5:-:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.5:alpha:*:*:*:*:*:* Versions 2.0.5 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.6:-:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.0.6:alpha:*:*:*:*:*:* Versions 2.0.6 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.1.0:-:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.1.0:beta:*:*:*:*:*:* Versions 2.1.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:2.1.1:beta:*:*:*:*:*:* Versions 2.1.1 beta Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:alpha3:*:*:*:*:*:* Versions 3.0.0 alpha3 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Apache
Remediation
- Fix · GHSA-hx83-rpqf-m267 org.apache.hadoop:hadoop-main (Maven) Fixed in 2.8.5 Advisory →
- Fix · GHSA-hx83-rpqf-m267 org.apache.hadoop:hadoop-main (Maven) Fixed in 2.9.2 Advisory →
- Fix · GHSA-hx83-rpqf-m267 org.apache.hadoop:hadoop-main (Maven) Fixed in 3.1.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
Not affected: 2 products
- Red Hat JBoss Data Grid 7
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11768
- 2026-10-03 Alias added: GHSA-hx83-rpqf-m267
References
Other 21
- https://lists.apache.org/thread.html/2067a797b330530a6932f4b08f703b3173253d0a2b7c8c524e54adaf%40%3Cgeneral.hadoop.apache.org%3E
- [hadoop-general] 20191004 Re:CVE-2018-11768: HDFS FSImage Corruption
- [hadoop-hdfs-dev] 20191004 Re:CVE-2018-11768: HDFS FSImage Corruption
- [hadoop-hdfs-dev] 20191004 Re: CVE-2018-11768: HDFS FSImage Corruption
- [hadoop-hdfs-dev] 20191006 Re: CVE-2018-11768: HDFS FSImage Corruption
- [lucene-dev] 20191029 Re: CVE-2018-11768 in regards to Solr
- [lucene-dev] 20191029 CVE-2018-11768 in regards to Solr
- [lucene-dev] 20191031 RE: CVE-2018-11768 in regards to Solr
- [flink-dev] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version
- [flink-user] 20200806 Dependency vulnerabilities with Apache Flink 1.10.1 version
- https://hadoop.apache.org/cve_list.html
- https://lists.apache.org/thread.html/2067a797b330530a6932f4b08f703b3173253d0a2b7c8c524e54adaf@%3Cgeneral.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/2c9cc65864be0058a5d5ed2025dfb9c700bf23d352b0c826c36ff96a@%3Chdfs-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/72ca514e01cd5f08151e74f9929799b4cbe1b6e9e6cd24faa72ffcc6@%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9b609d4392d886711e694cf40d86f770022baf42a1b1aa97e8244c87@%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/caacbbba2dcc1105163f76f3dfee5fbd22e0417e0783212787086378@%3Cgeneral.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/ceb16af9139ab0fea24aef935b6321581976887df7ad632e9a515dda@%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/ea6d2dfbefab8ebe46be18b05136b83ae53b7866f1bc60c680a2b600@%3Chdfs-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/f20bb4e055d8394fc525cc7772fb84096f706389043e76220c8a29a4@%3Chdfs-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cuser.flink.apache.org%3E
More Apache Hadoop vulnerabilities
- TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
- TI-2022-09898 Arbitrary file write in FileUtil#unpackEntries on Windows CVSS 3.1CRITICAL 9.8
- TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
- TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
- TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
- TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-11768 · CVE Program
- CVE-2018-11768 · NVD
- FIRST EPSS
- GHSA-hx83-rpqf-m267 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-11768 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences