SP
Product
Spark
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 11Low 0
Watch
Add Spark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-33891 In wildKEV | 8.8 | Jul 18 | Apache Spark shell command injection vulnerability via Spark UI Affected: through 3.0.3; 3.1.1 through 3.1.2; 3.2.0 through 3.2.1 |
| CVE-2023-22946 | 9.9 | Apr 17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges Affected: before 3.4.0 |
| CVE-2020-9480 | 9.8 | Jun 23 | In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret Affected: through 2.4.5 |
| CVE-2018-17190 | 9.8 | Nov 19 | In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts Affected: All versions, or not specified |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 2.4.7; 2.4.8 |
| CVE-2025-54920 | 8.8 | Mar 16 | This issue affects Apache Spark: before 3.5.7 and 4.0.1 Affected: before 3.5.7; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +4 more |
| CVE-2023-32007 | 8.8 | May 2 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable Affected: through 3.0.3; 3.1.1 through 3.1.3; 3.2.0 through 3.2.1 |
| CVE-2017-12612 | 7.8 | Sep 13 | In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 2.0.0; 2.0.1; +3 more |
| CVE-2021-38296 | 7.5 | Mar 10 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled" Affected: before 3.1.3 |
| CVE-2019-10172 | 7.5 | Nov 18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries Affected: 3.0.1 |
| CVE-2019-10099 | 7.5 | Aug 7 | Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true Affected: 1.0.2 through 1.6.3; 2.0.0 through 2.0.2; 2.1.0 through 2.1.3; 2.2.0 through 2.2.2; 2.3.0 before 2.3.2 |
| CVE-2018-11804 | 7.5 | Oct 24 | Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation Affected: 1.3.0 before 2.2.3; 2.3.0 before 2.3.3 |
| CVE-2025-55039 | 6.5 | Oct 15 | This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0 Affected: before 3.4.4; 3.5.0 before 3.5.2 |
| CVE-2026-32773 | 6.1 | Sep 2 | Apache Spark: XSS Vulnerability in Spark Web 3.5.4 Affected: 3.0.0 before 3.5.8 |
| CVE-2017-7678 | 6.1 | Jul 12 | In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark… Affected: through 2.1.1 |
| CVE-2024-23945 | 5.9 | Dec 23 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails Affected: 2.0.0 before 3.3.4; 3.4.0 before 3.4.2; 3.5.0 |
| CVE-2018-11760 | 5.5 | Feb 4 | When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application Affected: 1.0.2 through 1.6.3; 2.0.0 through 2.0.2; 2.1.0 through 2.1.3; 2.2.0 through 2.2.2; 2.3.0 through 2.3.1 |
| CVE-2022-31777 | 5.4 | Nov 1 | Apache Spark XSS vulnerability in log viewer UI Javascript Affected: before 3.2.2; 3.3.0 |
| CVE-2018-8024 | 5.4 | Jul 12 | In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and… Affected: 2.1.0 through 2.1.2; 2.2.0 through 2.2.1; 2.3.0 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 3.1.1 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 2.4.8; 3.0.3 |
| CVE-2018-1334 | 4.7 | Jul 12 | In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and… Affected: through 2.1.2; 2.2.0 through 2.2.1; 2.3.0 |
| CVE-2018-11770 | 4.2 | Aug 13 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit Affected: 1.3.0 before 2.4.0 |
Showing 23