Apache Software Foundation Apache Spark vulnerabilities

23 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Exploited Apache Software Foundation Apache Spark vulnerabilities

CVE-2026-32773 — Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (CVSS 6.1)
CVE-2025-54920 — Apache Spark: Spark History Server Code Execution Vulnerability (CVSS 8.8)
CVE-2025-55039 — Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks (CVSS 6.5)
CVE-2024-23945 — Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails (CVSS 5.9)
CVE-2023-32007 — Apache Spark: Shell command injection via Spark UI (CVSS 8.8)
CVE-2023-22946 — Apache Spark proxy-user privilege escalation from malicious configuration class (CVSS 9.9)
CVE-2022-31777 — Apache Spark XSS vulnerability in log viewer UI Javascript (CVSS 5.4)
CVE-2022-33891 — Apache Spark Command Injection Vulnerability (CVSS 8.8) — exploited
CVE-2021-38296 — Apache Spark Key Negotiation Vulnerability (CVSS 7.5)
CVE-2020-27223 — (CVSS 5.3)
CVE-2020-27218 — (CVSS 4.8)
CVE-2020-9480 — (CVSS 9.8)
CVE-2019-20445 — (CVSS 9.1)
CVE-2019-10172 — (CVSS 7.5)
CVE-2019-10099 — (CVSS 7.5)
CVE-2018-11760 — (CVSS 5.5)
CVE-2018-17190 — (CVSS 9.8)
CVE-2018-11804 — (CVSS 7.5)
CVE-2018-11770 — (CVSS 4.2)
CVE-2018-8024 — (CVSS 5.4)
CVE-2018-1334 — (CVSS 4.7)
CVE-2017-12612 — (CVSS 7.8)
CVE-2017-7678 — (CVSS 6.1)