{"action":"Upgrade org.apache.hive:hive-metastore to 4.2.0 or later.","affected":[{"fixed":"4.2.0","introduced":"4.1.0"}],"component":"org.apache.hive:hive-metastore","cve_ids":["CVE-2025-62728"],"ecosystem":"Maven","epss":0.00423,"exploited":false,"fixed_versions":["4.2.0"],"ghsa_id":"GHSA-932v-x9x2-vq29","id":"tcs_01M5N8NWSBK35VS72Y0MG7VCM2","modified_at":"2025-12-01T19:28:43.862260Z","published_at":"2025-11-26T09:31:22Z","references":["https://osv.dev/vulnerability/GHSA-932v-x9x2-vq29","https://nvd.nist.gov/vuln/detail/CVE-2025-62728","https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301","https://github.com/apache/hive","https://issues.apache.org/jira/browse/HIVE-29269","https://lists.apache.org/thread/yj65dd8dmzgy8p3nv8zy33v8knzg9o7g","http://www.openwall.com/lists/oss-security/2025/11/26/3"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-932v-x9x2-vq29#Maven/org.apache.hive:hive-metastore","url":"https://osv.dev/vulnerability/GHSA-932v-x9x2-vq29"},{"source":"nvd","source_id":"CVE-2025-62728","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62728"}],"summary":"Hive Metastore Server is vulnerable to SQL Injection"}