Apache HBase Vulnerabilities by Version: CVEs for HBase 1.7, 2.x and 3.0

The short answer

The HBase project maintains three lines: 2.5 and 2.6, whose latest releases are 2.5.16 and 2.6.7 from 1 October 2026, and 3.0, which shipped 3.0.0 on 5 August 2026. Every older line is end of maintenance. The one HBase CVE published in 2026, CVE-2026-49326, lets a user of the Thrift or REST gateway read rows from a scanner another user opened. It is fixed in 2.5.15, 2.6.6 and 3.0.0-beta-2, and the advisory's range runs through every 2.4 release with no fix on that line.

HBase has published few CVEs of its own: NVD has five records that name Apache HBase, the oldest from 2013. On the older lines the larger exposure is often what HBase ships with: 1.7.2 and 2.2.7 build against ZooKeeper 3.4.10, and 2.3.7 against 3.5.7, both from ZooKeeper lines that no longer get fixes.

HBase release lines and their CVEs

Release dates are from the HBase downloads page and the Apache release announcements. End-of-maintenance dates are from the release manager table in the HBase Reference Guide. Each row lists the HBase CVEs whose ranges include the line and that have no fix in its latest release.

The advisory for CVE-2026-49326 gives its range as "through 2.4.*" and names the hbase-thrift artifact, so it does not exclude 1.7, 2.2 or 2.3, and no fix exists for any of them. For release dates on every line, see the Apache HBase end-of-life chart and HBase 2.4 end of life.

Notable HBase CVEs by release line

CVSS is NVD's own score where NVD has scored the record, otherwise the CVSS 3.1 score CISA-ADP added. The Apache advisory rates CVE-2026-49326 important. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalogue.

All four rows are about the edges of an HBase cluster rather than the region servers themselves. Three concern the Thrift and REST gateways, which turn many end users into requests made by one gateway process. CVE-2026-49326 matters only where a gateway serves more than one user, for example with hbase.thrift.support.proxyuser or hbase.rest.support.proxyuser turned on, because a scanner ID opened by one user can then be used by another. The fix shipped in 2.5.15 and 2.6.6 in June 2026, and the advisory followed on 24 July 2026, so a cluster that took those releases was covered before the CVE was public.

The bundled ZooKeeper is the other half of the picture. HBase 1.7.2 and 2.2.7 build against ZooKeeper 3.4.10, which is inside the range of CVE-2019-0201, an ACL disclosure scored 5.9 by NVD that exposes digest authentication hashes. 2.3.7 builds against 3.5.7 and 2.4.18 against 3.8.4, which sits inside the range of the ZooKeeper advisories published in September 2026. Where HBase manages its own ensemble, that bundled version is the ZooKeeper server in production.

What each line gets

HBase 2.5, 2.6 and 3.0

These are the maintained lines, and 2.5.16, 2.6.7 and 3.0.0 carry every fix above. The downloads page marks 2.5 as the stable release. 3.0 is a new major version, so moving to it is a planned upgrade rather than a patch.

HBase 2.4

2.4.18, from 25 May 2024, was the last 2.4 release, and the reference guide lists the line as end of maintenance from June 2024. It has no fix for CVE-2026-49326. A move to 2.5 or 2.6 is a minor upgrade that can be done as a rolling restart; see upgrading HBase 2.4 to 2.5 or 2.6.

HBase 2.2 and 2.3

Both lines ended in 2021 and have no fix for CVE-2026-49326. They also carry the older bundled ZooKeeper, 3.4.10 in 2.2.7 and 3.5.7 in 2.3.7. The reference guide keeps a separate Hadoop compatibility matrix for each line, so an HBase upgrade from here often brings a Hadoop upgrade with it.

HBase 1.7

1.7.2, from August 2022, closed out the 1.x series. It has the 2018 Thrift fix, but nothing from 2026, and it runs on ZooKeeper 3.4.10. Moving to 2.x is a major-version upgrade with its own section in the reference guide; for the options, see Apache HBase support options.

What to do on each line

• 2.5, 2.6 and 3.0. Take 2.5.16, 2.6.7 or 3.0.0.
• 2.4. Move to 2.5.16 or 2.6.7. Until then, stop the Thrift and REST gateways where nothing uses them, and where they serve several users, turn off proxy user support or run one gateway per user group.
• 1.7, 2.2 and 2.3. Plan the upgrade together with the Hadoop and ZooKeeper versions underneath, or take patched builds from a supplier that backports fixes. Until then, apply the same gateway steps, keep the Thrift, REST and ZooKeeper ports off untrusted networks, and check which ZooKeeper version your ensemble actually runs.

HBase usually shares its cluster with HDFS and YARN, so check the Hadoop line too; see Apache Hadoop vulnerabilities by version.

Where OSSeva fits

OSSeva ships patched, signed builds of Apache HBase 1.7, 2.2, 2.3 and 2.4 with region data untouched and the bundled ZooKeeper patched in the same build, along with transitive dependency patching for Netty, Jetty, Jackson and log4j, delivered as Maven artifacts, Docker images and tarballs with VEX statements for scanner findings. OSSeva backports fixes of this class to the end-of-life release lines it patches. They are available now on the Patch, Assure and Operate tiers. Assure adds a master, region server and ZooKeeper quorum review, a Kerberos, ACL and coprocessor exposure audit, and an upgrade plan to 2.5, 2.6 or 3.0, and Operate adds 24/7 region, compaction and RPC latency monitoring with a 15-minute P1 response and a named senior HBase engineer. See Apache HBase support and HBase extended support.