SP
Product
Spark
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 11Low 0
Watch
Add Spark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-33891 In wildKEV | 8.8 | Jul 18 | Apache Spark shell command injection vulnerability via Spark UI Affected: through 3.0.3; 3.1.1 through 3.1.2; 3.2.0 through 3.2.1 |
| CVE-2025-54920 | 8.8 | Mar 14 | Apache Spark: Spark History Server Code Execution Vulnerability Affected: before 3.5.7; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +4 more |
| CVE-2023-32007 | 8.8 | May 2 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable Affected: through 3.0.3; 3.1.1 through 3.1.3; 3.2.0 through 3.2.1 |
| CVE-2017-12612 | 7.8 | Sep 13 | In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 2.0.0; 2.0.1; +3 more |
| CVE-2021-38296 | 7.5 | Mar 10 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled" Affected: before 3.1.3 |
| CVE-2019-10172 | 7.5 | Nov 18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries Affected: 3.0.1 |
| CVE-2019-10099 | 7.5 | Aug 7 | Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true Affected: 1.0.2 through 1.6.3; 2.0.0 through 2.0.2; 2.1.0 through 2.1.3; 2.2.0 through 2.2.2; 2.3.0 before 2.3.2 |
| CVE-2018-11804 | 7.5 | Oct 24 | Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation Affected: 1.3.0 before 2.2.3; 2.3.0 before 2.3.3 |
Showing 8