# org.apache.hive:hive-service (Maven) vulnerabilities

9 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 55
- Registry: https://central.sonatype.com/artifact/org.apache.hive/hive-service

## Advisories (9)

### [CVE-2026-53561](https://cve.now/CVE-2026-53561): Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

- Severity: High 7.4
- Published: Aug 25, 2026
- Affected: from 4.0.0, through 4.2.0.

### [CVE-2024-23945](https://cve.now/CVE-2024-23945): Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

- Severity: Medium 5.9
- Published: Dec 23, 2024
- Affected: from 1.2.0, fixed in 4.0.0; from 1.2.0, fixed in 4.0.0.

### [CVE-2018-1315](https://cve.now/CVE-2018-1315): In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server…

- Severity: Unrated
- Published: Apr 5, 2018
- Affected: from 2.1.0, fixed in 2.3.3.

### [CVE-2018-1284](https://cve.now/CVE-2018-1284): In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath\_string/xpath\_boolean/xpath\_number/xpath\_double/xpath\_fl…

- Severity: Unrated
- Published: Apr 5, 2018
- Affected: from 0.6.0, fixed in 2.3.3.

### [CVE-2017-12625](https://cve.now/CVE-2017-12625): Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be…

- Severity: Unrated
- Published: Nov 1, 2017
- Affected: from 2.1.0, fixed in 2.1.2; from 2.2.0, fixed in 2.2.1; from 2.3.0, fixed in 2.3.1.

### [CVE-2016-3083](https://cve.now/CVE-2016-3083): Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes).

- Severity: Unrated
- Published: May 30, 2017
- Affected: fixed in 1.2.2; from 2.0.0, fixed in 2.0.1.

### [CVE-2015-7521](https://cve.now/CVE-2015-7521): The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and…

- Severity: Unrated
- Published: Jan 29, 2016
- Affected: from 1.0.0, fixed in 1.2.2.

### [CVE-2015-1772](https://cve.now/CVE-2015-1772): The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0…

- Severity: Unrated
- Published: Dec 21, 2015
- Affected: from 1.0.0, fixed in 1.0.1; from 1.1.0, fixed in 1.1.1.

### [CVE-2014-0228](https://cve.now/CVE-2014-0228): Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and…

- Severity: Unrated
- Published: Nov 16, 2014
- Affected: fixed in 0.13.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.hive:hive-service
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.