Advisoriesby Ibis
Apache Spark security advisories
14 advisories · 1 critical or high in 12 months · latest Sep 2
14 advisories
Apache Spark History Server allows stored cross-site scripting through unescaped application namesCVE-2026-32773fixed in 3.5.8Apache Spark: cross-site scriptingCVE-2026-32773fixed in 3.5.8Apache Spark: Spark History Server Code Execution VulnerabilityCVE-2025-54920fixed in 3.5.7 +1Apache Spark has Inadequate Encryption StrengthCVE-2025-55039fixed in 3.4.4 +1Apache Spark UI vulnerable to Command InjectionCVE-2023-32007fixed in 3.2.2Apache Spark vulnerable to Improper Privilege ManagementCVE-2023-22946fixed in 3.3.2 +1Apache Spark vulnerable to Log InjectionCVE-2022-31777fixed in 3.2.2 +1Apache Spark UI can allow impersonation if ACLs enabledCVE-2022-33891fixed in 3.1.3 +1Authentication Bypass by Capture-replay in Apache SparkCVE-2021-38296fixed in 3.1.3Improper Authentication in Apache SparkCVE-2020-9480fixed in 2.4.6Sensitive data written to disk unencrypted in SparkCVE-2019-10099fixed in 2.3.3Exposure of Sensitive Information to an Unauthorized Actor in Apache SparkCVE-2018-1334fixed in 2.1.3 +1Pyspark User Impersonation VulnerabilityCVE-2018-11760fixed in 2.2.3 +1Apache Spark Deserialization of Untrusted Data vulnerabilityCVE-2017-12612fixed in 2.1.2About Apache Spark
The engine for large-scale data processing.
Packages watched: pyspark (PyPI), org.apache.spark:spark-core_2.13 (Maven), org.apache.spark:spark-core_2.12 (Maven).