Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/hadoop

              trunk @ abbc78d
            

249

Fixes

CVEs

CRITICAL

Peak severity

52.6%

Coverage

Highlights

Auth Bypass: 115 prior fixes. Scrutinize any change in this area.

hadoop-project/pom.xml: most-fixed (41 issues). Treat as high-risk during review.

213 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Hundreds of fixes address authentication bypasses via incorrect user identity propagation, proxy-user handling, and token validation; these are the highest-frequency and highest-impact class.

Authorization Bypass: Missing or incorrectly ordered permission/ACL checks on rename, content summary, setOwner, and Azure operations allow unauthorized access; symlink and sticky-bit edge cases also bypass checks.

Dependency Vulnerability: Recurring CVEs in Netty, Jetty, Jackson, BouncyCastle, lz4, and other libraries require constant upgrades; deserialization allowlists (Avro, Kafka) are critical for RCE prevention.