Apache Software Foundation Apache Spark
16 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-32773 | 3.0.0 – < 3.5.8 | Apache Spark: XSS Vulnerability in Spark Web 3.5.4 | MEDIUM 6.1 | 0.4 % | ||
| CVE-2025-54920 | < 3.5.7 ; 4.0.0 – < 4.0.1 | Apache Spark: Spark History Server Code Execution Vulnerability | HIGH 8.8 | 5.4 % | ||
| CVE-2025-55039 | 3.5.0 – < 3.5.2 ; < 3.4.4 | Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification a… | MEDIUM 6.5 | 0.2 % | ||
| CVE-2024-23945 | 2.0.0 – < 3.0.0 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails | MEDIUM 5.9 | 1.6 % | ||
| CVE-2023-32007 | 3.1.1 – < 3.2.2 | Apache Spark: Shell command injection via Spark UI | HIGH 8.8 | 76 % | ||
| CVE-2023-22946 | < 3.4.0 | Apache Spark proxy-user privilege escalation from malicious configuration class | CRITICAL 9.9 | 1.1 % | ||
| CVE-2022-31777 | 3.3.0 ; 3.2.1 and earlier – 3.2.1 | Apache Spark XSS vulnerability in log viewer UI Javascript | MEDIUM 5.4 | 1.8 % | ||
| CVE-2022-33891 | 3.0.3 and earlier – 3.0.3 ; 3.1.1 to 3.1.2 – 3.1.2 ; 3.2.0 to 3.2.1 – 3.2.1 | Apache Spark shell command injection vulnerability via Spark UI | HIGH 8.8 | 93 % | KEV | |
| CVE-2021-38296 | up to and including version 3.1.2 – 3.1.2 | Apache Spark Key Negotiation Vulnerability | HIGH 7.5 | 1.8 % | ||
| CVE-2020-9480 | Apache Spark 2.4.5 and earlier | In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) v | CRITICAL 9.8 | 29 % | ||
| CVE-2018-11760 | Apache Spark 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1 | When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark | MEDIUM 5.5 | 0.6 % | ||
| CVE-2018-17190 | All versions | In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'wo | CRITICAL 9.8 | 8.8 % | ||
| CVE-2018-11804 | 1.3.0 – < 3.* | Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. | HIGH 7.5 | 5.7 % | ||
| CVE-2018-11770 | 1.3.0 – < 2.4.0 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism u | MEDIUM 4.2 | 66 % | ||
| CVE-2018-8024 | 1.0.0 to 2.1.2 ; 2.2.0 to 2.2.1 ; 2.3.0 | In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster | MEDIUM 5.4 | 5.3 % | ||
| CVE-2018-1334 | 1.0.0 to 2.1.2 ; 2.2.0 to 2.2.1 ; 2.3.0 | In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect | MEDIUM 4.7 | 0.5 % |