CVE-2025-62728

SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exploitable by trusted/authorized users/applications that are allowed to call directly the Thrift APIs. In most real-world deployments, HMS is accessible to only a handful of applications (e.g., Hiveserver2) thus the vulnerability is not exploitable. Moreover, the vulnerable code cannot be reached when metastore.try.direct.sql property is set to false. This issue affects Apache Hive: from 4.1.0 before 4.2.0. Users are recommended to upgrade to version 4.2.0, which fixes the issue. Users who cannot upgrade directly are encouraged to set metastore.try.direct.sql property to false if the HMS Thrift APIs are exposed to general public.

• CWE-89

• https://lists.apache.org/thread/yj65dd8dmzgy8p3nv8zy33v8knzg9o7gVendor Advisory
• http://www.openwall.com/lists/oss-security/2025/11/26/3Mailing List, Third Party Advisory

Published

Nov 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62722LinkAce is a self-hosted archive to collect website links. I…5.4
• CVE-2025-62723FlashMQ is a MQTT broker/server, designed for multi-CPU envi…4.3
• CVE-2025-62724Open OnDemand is an open-source HPC portal. Prior to version…4.3
• CVE-2025-62725Docker Compose trusts the path information embedded in remot…8.9
• CVE-2025-62726n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2025-62727Starlette is a lightweight ASGI framework/toolkit. Starting …7.5
• CVE-2025-62729SOPlanning is vulnerable to Stored XSS in /status endpoint. …5.4
• CVE-2025-6273A vulnerability was found in WebAssembly wabt up to 1.0.37 a…3.3
• CVE-2025-62730SOPlanning is vulnerable to Privilege Escalation in user man…8.8
• CVE-2025-62731SOPlanning is vulnerable to Stored XSS in /feries endpoint. …4.8
• CVE-2025-62733Cross-Site Request Forgery (CSRF) vulnerability in ProteusTh…4.3
• CVE-2025-62734Cross-Site Request Forgery (CSRF) vulnerability in M.Code Me…4.3