Apache Software Foundation Spark vulnerabilities

• apache spark Apache Spark: XSS Vulnerability in Spark Web 3.5.4 CVE-2026-32773 Fix available 6.1 MediumSeptember 2, 2026
• apache spark Apache Spark: Spark History Server Code Execution Vulnerability CVE-2025-54920 Fix available 8.8 HighMarch 14, 2026
• apache spark Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks CVE-2025-55039 Fix available 6.5 MediumOctober 15, 2025
• apache hive, spark +1 more Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails CVE-2024-23945 Fix available 5.9 MediumDecember 23, 2024
• apache spark Apache Spark: Shell command injection via Spark UI CVE-2023-32007 Fix available EPSS 75.8% 8.8 HighMay 2, 2023
• apache spark Apache Spark proxy-user privilege escalation from malicious configuration class CVE-2023-22946 Fix available 6.4 MediumApril 17, 2023
• apache spark Apache Spark XSS vulnerability in log viewer UI Javascript CVE-2022-31777 Fix available 5.4 MediumNovember 1, 2022
• apache spark Apache Spark shell command injection vulnerability via Spark UI CVE-2022-33891 In KEVPublic exploitFix available EPSS 93.2% 8.8 HighJuly 18, 2022
• apache spark, oracle financial services crime and compliance management studio +1 more Apache Spark Key Negotiation Vulnerability CVE-2021-38296 Fix available 7.5 HighMarch 10, 2022
• apache spark, oracle business intelligence +1 more Improper Authentication in Apache Spark CVE-2020-9480 Public exploitFix available EPSS 29.2% 9.8 CriticalJune 23, 2020
• apache spark Sensitive data written to disk unencrypted in Spark CVE-2019-10099 Fix available 7.5 HighAugust 7, 2019
• apache spark Pyspark User Impersonation Vulnerability CVE-2018-11760 Fix available 5.5 MediumFebruary 4, 2019
• apache spark Remote Code Execution in spark-core CVE-2018-17190 9.8 CriticalNovember 19, 2018
• apache spark Improper Input Validation in Apache Spark CVE-2018-11804 7.5 HighOctober 24, 2018
• apache spark org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability CVE-2018-11770 Public exploit EPSS 66.1% 4.2 MediumAugust 13, 2018
• apache spark, mozilla firefox +1 more Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL CVE-2018-8024 Fix available 5.4 MediumJuly 12, 2018
• apache spark Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark CVE-2018-1334 Fix available 4.7 MediumJuly 12, 2018