yugabyte CVE Vulnerabilities & Metrics

Focus on yugabyte vulnerabilities and metrics.

Last updated: 08 Jul 2025, 22:25 UTC

About yugabyte Security Exposure

This page consolidates all known Common Vulnerabilities and Exposures (CVEs) associated with yugabyte. We track both calendar-based metrics (using fixed periods) and rolling metrics (using gliding windows) to give you a comprehensive view of security trends and risk evolution. Use these insights to assess risk and plan your patching strategy.

For a broader perspective on cybersecurity threats, explore the comprehensive list of CVEs by vendor and product. Stay updated on critical vulnerabilities affecting major software and hardware providers.

Global CVE Overview

Total yugabyte CVEs: 7
Earliest CVE date: 05 Aug 2019, 17:15 UTC
Latest CVE date: 03 Sep 2024, 19:15 UTC

Latest CVE reference: CVE-2024-41435

Rolling Stats

30-day Count (Rolling): 0
365-day Count (Rolling): 1

Calendar-based Variation

Calendar-based Variation compares a fixed calendar period (e.g., this month versus the same month last year), while Rolling Growth Rate uses a continuous window (e.g., last 30 days versus the previous 30 days) to capture trends independent of calendar boundaries.

Variations & Growth

Month Variation (Calendar): 0%
Year Variation (Calendar): -66.67%

Month Growth Rate (30-day Rolling): 0.0%
Year Growth Rate (365-day Rolling): -66.67%

Monthly CVE Trends (current vs previous Year)

Annual CVE Trends (Last 20 Years)

Critical yugabyte CVEs (CVSS ≥ 9) Over 20 Years

CVSS Stats

Average CVSS: 0.3

Max CVSS: 2.1

Critical CVEs (≥9): 0

CVSS Range vs. Count

Range Count
0.0-3.9 7
4.0-6.9 0
7.0-8.9 0
9.0-10.0 0

CVSS Distribution Chart

Top 5 Highest CVSS yugabyte CVEs

These are the five CVEs with the highest CVSS scores for yugabyte, sorted by severity first and recency.

All CVEs for yugabyte

CVE-2024-41435 yugabyte vulnerability CVSS: 0 03 Sep 2024, 19:15 UTC

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.

CVE-2023-6002 yugabyte vulnerability CVSS: 0 08 Nov 2023, 00:15 UTC

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

CVE-2023-6001 yugabyte vulnerability CVSS: 0 08 Nov 2023, 00:15 UTC

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

CVE-2023-4640 yugabyte vulnerability CVSS: 0 30 Aug 2023, 17:15 UTC

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3

CVE-2023-0575 yugabyte vulnerability CVSS: 0 09 Feb 2023, 17:15 UTC

External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.0.0

CVE-2022-37397 yugabyte vulnerability CVSS: 0 12 Aug 2022, 20:15 UTC

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

CVE-2019-3800 yugabyte vulnerability CVSS: 2.1 05 Aug 2019, 17:15 UTC

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.