-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hive:hive-exec | maven | = 4.0.0-alpha-1 | 4.0.0-alpha-2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated deserialization in deserializeObjectWithTypeInformation. The commit diff shows this method was modified to add a 'isPartFilter' parameter and type validation in KryoWithHooks.getRegistration(). Prior to the patch, calls to this method (like in PartitionExpressionForMetastore.java) didn't enforce that the first deserialized object was an ExprNodeDesc, enabling RCE via malicious payloads. The CVE description and patch context confirm this was the entry point for unsafe deserialization.
KEV Misses 88% of Exploited CVEs- Get the report