{"id":"CVE-2021-37404","details":"There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","aliases":["GHSA-rmpj-7c96-mrg8"],"modified":"2026-07-08T22:13:41.387799Z","published":"2022-06-13T07:15:08.327Z","references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220715-0007/"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/hadoop","events":[{"introduced":"756ebc8394e473ac25feac05fa493f6d612e6c50"},{"fixed":"965fd380006fa78b2315668fbc7eb432e1d8200f"},{"introduced":"c25427ceca461ee979d30edd7a4b0f50718e6533"},{"last_affected":"1e877761e8dadd71effef30e592368f7fe66a61b"},{"introduced":"e97acb3bd8f3befd27418996fa5d4b50bf2e17bf"},{"fixed":"abe5358143720085498613d399be3bbf01e0f131"},{"introduced":"aa96f1871bfd858f9bac59cf2a81ec470da649af"},{"fixed":"0bcb014209e219273cb6fd4152df7df713cbac61"}],"database_specific":{"cpe":"cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.9.0"},{"fixed":"2.10.2"},{"introduced":"3.0.0"},{"last_affected":"3.1.4"},{"introduced":"3.2.0"},{"fixed":"3.2.3"},{"introduced":"3.3.0"},{"fixed":"3.3.2"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37404.json","vanir_signatures_modified":"2026-07-08T22:13:41Z","vanir_signatures":[{"source":"https://github.com/apache/hadoop/commit/abe5358143720085498613d399be3bbf01e0f131","target":{"file":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/conf/Configuration.java","function":"getTimeDurationHelper"},"deprecated":false,"digest":{"function_hash":"172508901140850166315077168976677568660","length":705},"id":"CVE-2021-37404-cf0079d5","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/apache/hadoop/commit/abe5358143720085498613d399be3bbf01e0f131","target":{"file":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/conf/Configuration.java"},"deprecated":false,"digest":{"line_hashes":["117241420199337029436298470313516342337","10911464053357943410825609861845695837","240437666491262468440316638114074933731","226622566833744400926285549106341911654","249375286985992668764075164756526076674"],"threshold":0.9},"id":"CVE-2021-37404-f2b0819d","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}