Apache Software Foundation Apache Spark vulnerabilities

CVE-2025-54920 [HIGH] CWE-502 CVE-2025-54920: This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an at

CVE-2025-55039 [MEDIUM] CWE-326 CVE-2025-55039: This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions be This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly confi

CVE-2024-23945 [MEDIUM] CWE-209 CVE-2024-23945: Signing cookies is an application security feature that adds a digital signature to cookie data to v Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to

CVE-2023-32007 [HIGH] CWE-77 Apache Spark: Shell command injection via Spark UI Apache Spark: Shell command injection via Spark UI ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an

CVE-2023-22946 [MEDIUM] CWE-269 CVE-2023-22946: In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example t

CVE-2022-31777 [MEDIUM] CWE-74 CVE-2022-31777: A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allo A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.

CVE-2022-33891 [HIGH] CWE-78 CVE-2022-33891: The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.en The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user nam

CVE-2021-38296 [HIGH] CWE-294 CVE-2021-38296: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.n Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Not

CVE-2020-9480 [CRITICAL] CWE-306 CVE-2020-9480: In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to requi In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to exe

CVE-2018-11760 [MEDIUM] CVE-2018-11760: When using PySpark , it's possible for a different local user to connect to the Spark application an When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.

CVE-2018-17190 [CRITICAL] CVE-2018-17190: In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'maste In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters w

CVE-2018-11804 [HIGH] CVE-2018-11804: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal

CVE-2018-11770 [MEDIUM] CWE-287 CVE-2018-11770: From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, i From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use thi

CVE-2018-8024 [MEDIUM] CWE-200 CVE-2018-8024: In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to con In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like r

CVE-2018-1334 [MEDIUM] CWE-200 CVE-2018-1334: In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possib In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.