Apache Hadoop Vulnerabilities by Version: CVEs for Hadoop 2.x, 3.2, 3.3, 3.4 and 3.5

The short answer

Two Hadoop lines are getting releases: 3.5, whose first release 3.5.0 came out on 2 April 2026, and 3.4, whose latest is 3.4.3 from 24 February 2026. Hadoop sets no end-of-life dates in advance. The community votes a line end of life when nobody will make more releases from it, and 3.2 was the last to go, announced on 22 December 2023. 3.3 and 2.10 were never voted end of life, but 3.3.6 from 23 June 2023 and 2.10.2 from 31 May 2022 are their last releases. Two CVEs published since then, CVE-2024-23454 and CVE-2025-27821, are fixed only in the 3.4 line and later.

For the decision about what to do with a cluster past end of life, see Hadoop on an end-of-life version. This guide is the CVE lookup for each line.

Hadoop release lines and their CVEs

Release dates are from hadoop.apache.org, and end-of-life dates are from the votes on the Hadoop developer lists. Each row lists the CVEs from the Hadoop CVE list, plus CVE-2024-23454, that name the line and have no fix on it.

The Hadoop wiki still lists 3.3 and 2.10 among the active release lines, but neither has had a release in more than two years, and in the December 2023 discussion that ended 3.2, committers favoured keeping 2.10 alive only by cherry-picking critical CVE fixes into the branch, with no new release. For the dates on every line, see the Hadoop end-of-life chart.

Notable Hadoop CVEs by release line

CVSS is NVD's own score where NVD has scored the record. For the two newest CVEs NVD has no score of its own, and the figure is the CVSS 3.1 score CISA-ADP added. The Hadoop CVE list has 22 entries, two of which are notes explaining that Hadoop was not exposed to the Log4j 2 flaw Log4Shell, and that the Log4j 1.2 JMSAppender is not in its default configuration. CVE-2024-23454 is not on that list; it was announced on the general@hadoop mailing list. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalogue.

Hadoop's CVEs are mostly not network-facing in the way a broker's are. Several need an existing foothold on the cluster: a local account on a NodeManager host for CVE-2023-26031 and CVE-2024-23454, the yarn user for CVE-2021-33036 and CVE-2018-8029, or write access to ZooKeeper for CVE-2021-25642. That makes them escalation paths from an ordinary cluster user, or from a compromised job, to root on the worker nodes, and on a multi-tenant cluster that is the boundary that matters. The native client flaws, CVE-2021-37404 and CVE-2025-27821, matter wherever applications use libhdfs or the native HDFS client with paths or URIs they did not build themselves.

What each line gets

Hadoop 3.5 and 3.4

3.5.0 and 3.4.3 carry every fix above. 3.5 is the first release with full Java 17 support and requires Java 17 on the server side, so 3.4 is the step for clusters that cannot move their JDK yet. A cluster on 3.4.0 or 3.4.1 should move to 3.4.3 for CVE-2025-27821.

Hadoop 3.3

3.3.6 has every fix up to CVE-2023-26031, which 3.3.5 fixed, but nothing since. CVE-2025-27821 lists 3.3 as affected and has a fix only in 3.4.2, and CVE-2024-23454 is fixed only from 3.4.0. 3.3 to 3.4 is a minor upgrade within Hadoop 3, but it brings new versions of the libraries Hadoop bundles, so test the jobs that depend on them.

Hadoop 3.2

3.2 was voted end of life in December 2023, more than a year after its last release, 3.2.4. That release carries the 2022 fixes, including CVE-2022-25168 and CVE-2021-25642, but not CVE-2025-27821 or CVE-2024-23454.

Hadoop 2.10

2.10.2 carries the 2022 fixes for CVE-2022-25168, CVE-2021-37404, CVE-2021-25642 and CVE-2021-33036. It does not carry CVE-2024-23454, and CVE-2022-26612 was fixed only in 3.2.3 and 3.3.3, which matters only for YARN daemons on Windows. Moving from 2.10 to 3.x changes the Java version, the default ports and the shell scripts; see the Hadoop 2 to 3 upgrade guide.

Hadoop 3.1, 3.0, 2.9 and older

These lines stopped before the 2021 and 2022 CVEs were fixed, so they carry none of those fixes, including CVE-2022-25168 and, from 2.9, CVE-2021-37404, both scored 9.8. 3.1.4 did get the fix for CVE-2020-9492, but 2.9.2, 2.8.5 and 3.0.3 did not. Many clusters on these versions are vendor distributions rather than Apache releases: CDH 6 is built on Hadoop 3.0.0 and HDP 3.1 on Hadoop 3.1.1, with the vendor's own patches on top, so check the vendor build as well as the Apache version. See Cloudera CDH 6 end of life and HDP 3.1 end of life.

Every production Hadoop cluster also runs ZooKeeper for NameNode and ResourceManager high availability, often at the version its Hadoop release bundled; see ZooKeeper for Hadoop.

What to do on each line

• 3.5 and 3.4. Stay on 3.5.0 or 3.4.3.
• 3.3 and 3.2. Move to 3.4.3, or take patched builds. Until then, keep libhdfs and native client callers from passing paths built from untrusted input, and limit which local users can log in to hosts where jobs are launched with hadoop jar, for CVE-2024-23454.
• 2.10. Plan the move to 3.4 or 3.5, or take patched builds. Do not run YARN daemons as a user that can create symlinks on Windows.
• 3.1 and older. Move to a supported 3.x line, or take patched builds from a supplier that backports fixes. Meanwhile, remove setuid from container-executor where you do not use secure containers, restrict who can become the yarn user, lock down write access to the ZooKeeper nodes YARN uses, and require SPNEGO on every web UI when Kerberos is on.

Where OSSeva fits

OSSeva ships patched, GPG-signed builds for Hadoop 2.8, 2.9, 2.10, 3.1, 3.2 and 3.3, and for CDH 5.14 to 5.16, CDH 6.2 and 6.3, HDP 2.6 and HDP 3.1, with security backports for HDFS, YARN and MapReduce, transitive dependency patching for Jetty, Netty, Jackson and log4j, and VEX statements for scanner findings. OSSeva backports fixes of this class to the end-of-life release lines it patches. Builds ship as tarballs, RPMs and parcels, and are available now on the Patch, Assure and Operate tiers. Assure adds a Kerberos, Ranger or Sentry policy and exposure audit, a component version map across the cluster and a migration plan to Hadoop 3.4 or 3.5, CDP or a cloud platform, and Operate adds 24/7 HDFS and YARN monitoring with a 15-minute P1 response and a named senior Hadoop engineer. See Apache Hadoop support and Hadoop extended support.