CVE-2021-37404: 
Java vulnerability analysis and mitigation

A critical heap buffer overflow vulnerability (CVE-2021-37404) was discovered in Apache Hadoop's libhdfs native code. The vulnerability affects Apache Hadoop versions prior to 2.10.2, 3.2.3, and 3.3.2. The issue was publicly disclosed on June 13, 2022, and received a CVSS v3.1 base score of 9.8 (Critical) (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) that occurs when opening a file path provided by a user without proper validation in the libhdfs native code component. The severity assessment indicates a Critical rating with a CVSS v3.1 base score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting the ease of exploitation and potential for complete system compromise (NVD).

Successful exploitation of this vulnerability could lead to denial of service conditions or arbitrary code execution. The impact includes potential disclosure of sensitive information, addition or modification of data, and system disruption (NetApp Advisory).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. Public discussions about this vulnerability have been acknowledged by security vendors (NetApp Advisory).

Users are advised to upgrade to Apache Hadoop versions 2.10.2, 3.2.3, 3.3.2 or higher to address this vulnerability. No temporary workarounds have been identified (Apache Mailing List).