SP
Product
Spark
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 11Low 0
Watch
Add Spark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-55039 | 6.5 | Oct 15 | This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0 Affected: before 3.4.4; 3.5.0 before 3.5.2 |
| CVE-2026-32773 | 6.1 | Sep 2 | Apache Spark: XSS Vulnerability in Spark Web 3.5.4 Affected: 3.0.0 before 3.5.8 |
| CVE-2017-7678 | 6.1 | Jul 12 | In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark… Affected: through 2.1.1 |
| CVE-2024-23945 | 5.9 | Dec 23 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails Affected: 2.0.0 before 3.3.4; 3.4.0 before 3.4.2; 3.5.0 |
| CVE-2018-11760 | 5.5 | Feb 4 | When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application Affected: 1.0.2 through 1.6.3; 2.0.0 through 2.0.2; 2.1.0 through 2.1.3; 2.2.0 through 2.2.2; 2.3.0 through 2.3.1 |
| CVE-2022-31777 | 5.4 | Nov 1 | Apache Spark XSS vulnerability in log viewer UI Javascript Affected: before 3.2.2; 3.3.0 |
| CVE-2018-8024 | 5.4 | Jul 12 | In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and… Affected: 2.1.0 through 2.1.2; 2.2.0 through 2.2.1; 2.3.0 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 3.1.1 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 2.4.8; 3.0.3 |
| CVE-2018-1334 | 4.7 | Jul 12 | In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and… Affected: through 2.1.2; 2.2.0 through 2.2.1; 2.3.0 |
| CVE-2018-11770 | 4.2 | Aug 13 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit Affected: 1.3.0 before 2.4.0 |
Showing 11