Schwachstellen verstehen. Anwendungen schützen.

Mittel 02.09.2026

CVE-2026-32773

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13, pyspark

Mittel 15.10.2025

CVE-2025-55039

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-network-common_2.12, org.apache.spark:spark-network-common_2.13, pyspark

Hoch 02.05.2023

CVE-2023-32007

** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-parent_2.12, pyspark

Kritisch 17.04.2023

CVE-2023-22946

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitti

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13, pyspark

Mittel 01.11.2022

CVE-2022-31777

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a mal

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11, org.apache.spark:spark-core_2.12 +3

Hoch In Angriffen ausgenutzt 18.07.2022

CVE-2022-33891

Apache Spark UI can allow impersonation if ACLs enabled

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-parent_2.12, pyspark

Hoch 10.03.2022

CVE-2021-38296

Authentication Bypass by Capture-replay in Apache Spark

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core, pyspark

Kritisch 23.06.2020

CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-parent_2.11, pyspark

Hoch 07.08.2019

CVE-2019-10099

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (contr

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.11, pyspark

Mittel 12.07.2018

CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running t

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11, pyspark

Mittel 04.02.2019

CVE-2018-11760

Pyspark User Impersonation Vulnerability

Python (PyPI)

pyspark

Hoch 13.09.2017

CVE-2017-12612

Apache Spark Deserialization of Untrusted Data vulnerability

Java / Kotlin (Maven) Python (PyPI)

org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11, pyspark