Apache Spark vulnerabilities

• apache spark Apache Spark: XSS Vulnerability in Spark Web 3.5.4 CVE-2026-32773 Fix available 6.1 MediumSeptember 2, 2026
• apache spark Apache Spark: Spark History Server Code Execution Vulnerability CVE-2025-54920 Fix available 8.8 HighMarch 14, 2026
• apache spark Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks CVE-2025-55039 Fix available 6.5 MediumOctober 15, 2025
• apache hive, spark +1 more Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails CVE-2024-23945 Fix available 5.9 MediumDecember 23, 2024
• apache airflow spark provider Apache Airflow Spark Provider Deserialization Vulnerability RCE CVE-2023-40195 Fix available 8.8 HighAugust 28, 2023
• apache software foundation airflow spark provider, apache apache-airflow-providers-apache-drill, apache-airflow-providers-apache-spark +2 more Apache Airflow Spark Provider Arbitrary File Read via JDBC CVE-2023-40272 Fix available 7.5 HighAugust 17, 2023
• apache spark Apache Spark: Shell command injection via Spark UI CVE-2023-32007 Fix available EPSS 76.0% 8.8 HighMay 2, 2023
• apache spark Apache Spark proxy-user privilege escalation from malicious configuration class CVE-2023-22946 Fix available 6.4 MediumApril 17, 2023
• apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +1 more Apache Airflow Spark Provider Arbitrary File Read via JDBC CVE-2023-28710 Fix available 7.5 HighApril 7, 2023
• apache airflow, apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +2 more Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files CVE-2022-40954 Fix available 5.5 MediumNovember 22, 2022
• apache spark Apache Spark XSS vulnerability in log viewer UI Javascript CVE-2022-31777 Fix available 5.4 MediumNovember 1, 2022
• apache spark Apache Spark shell command injection vulnerability via Spark UI CVE-2022-33891 In KEVPublic exploitFix available EPSS 93.2% 8.8 HighJuly 18, 2022
• apache spark, oracle financial services crime and compliance management studio +1 more Apache Spark Key Negotiation Vulnerability CVE-2021-38296 Fix available 7.5 HighMarch 10, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, apache nifi +14 more +16 more DOS vulnerability for Quoted Quality CSV headers CVE-2020-27223 Public exploitFix available EPSS 78.0% 5.2 MediumFebruary 26, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache kafka +15 more +17 more Buffer not correctly recycled in Gzip Request inflation CVE-2020-27218 Fix available 4.8 MediumNovember 28, 2020
• apache spark, oracle business intelligence +1 more Improper Authentication in Apache Spark CVE-2020-9480 Public exploitFix available EPSS 29.4% 9.8 CriticalJune 23, 2020
• netty, apache spark, canonical ubuntu linux +4 more +6 more HTTP Request Smuggling in Netty CVE-2019-20445 Fix available EPSS 13.8% 9.1 CriticalJanuary 29, 2020
• fasterxml jackson-mapper-asl, apache spark, debian linux +2 more +4 more Improper Restriction of XML External Entity Reference in jackson-mapper-asl CVE-2019-10172 Public exploitFix available EPSS 17.0% 5.9 MediumNovember 18, 2019
• apache spark Sensitive data written to disk unencrypted in Spark CVE-2019-10099 Fix available 7.5 HighAugust 7, 2019
• apache spark Pyspark User Impersonation Vulnerability CVE-2018-11760 Fix available 5.5 MediumFebruary 4, 2019
• apache spark Remote Code Execution in spark-core CVE-2018-17190 9.8 CriticalNovember 19, 2018
• apache spark Improper Input Validation in Apache Spark CVE-2018-11804 7.5 HighOctober 24, 2018
• apache spark org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability CVE-2018-11770 Public exploit EPSS 66.1% 4.2 MediumAugust 13, 2018
• apache spark, mozilla firefox +1 more Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL CVE-2018-8024 Fix available 5.4 MediumJuly 12, 2018
• apache spark Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark CVE-2018-1334 Fix available 4.7 MediumJuly 12, 2018
• apache spark Apache Spark Deserialization of Untrusted Data vulnerability CVE-2017-12612 Fix available 7.8 HighSeptember 13, 2017
• apache spark Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 CVE-2017-7678 Fix available 6.1 MediumJuly 12, 2017