oss-security - CVE-2025-27821: HDFS native client: Out of bounds write in URI parser of native HDFS client

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b57ffd96-79ad-11db-cc49-b577e789e640@apache.org>
Date: Fri, 23 Jan 2026 18:45:29 +0000
From: Chris Nauroth <cnauroth@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-27821: HDFS native client: Out of bounds write in URI
 parser of native HDFS client 

Severity: moderate 

Affected versions:

- HDFS native client (org.apache.hadoop:hadoop-hdfs-native-client) 3.2.0 before 3.4.2

Description:

Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client.

This issue affects Apache Hadoop: from 3.2.0 before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

This issue is being tracked as HDFS-17754 

Credit:

BUI Ngoc Tan (reporter)

References:

https://hadoop.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-27821
https://issues.apache.org/jira/browse/HDFS-17754

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.