Apache Spark vulnerabilities

23 CVEs affecting Apache Spark, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-32773, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-33891: Apache Spark Command Injection Vulnerability, published 2022-07-18. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-03-07. EPSS: 93.2% chance of exploitation in the next 30 days. The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2023-32007, published 2023-05-02. High severity, CVSS 8.8. EPSS: 76% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has…
CVE-2018-11770, published 2018-08-13. Medium severity, CVSS 4.2. EPSS: 65.8% chance of exploitation in the next 30 days. From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property…
CVE-2020-9480, published 2020-06-23. Critical severity, CVSS 9.8. EPSS: 29.4% chance of exploitation in the next 30 days. In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a…
CVE-2019-10172, published 2019-11-18. High severity, CVSS 7.5. EPSS: 17% chance of exploitation in the next 30 days. A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in…
CVE-2019-20445, published 2020-01-29. Critical severity, CVSS 9.1. EPSS: 13.8% chance of exploitation in the next 30 days. HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
CVE-2018-17190, published 2018-11-19. Critical severity, CVSS 9.8. EPSS: 8.8% chance of exploitation in the next 30 days. In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute…
CVE-2020-27218, published 2020-11-28. Medium severity, CVSS 4.8. EPSS: 8.3% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients…
CVE-2018-11804, published 2018-10-24. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to…

Latest

CVE-2026-32773, published 2026-09-02. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege…
CVE-2025-54920, published 2026-03-16. High severity, CVSS 8.8. EPSS: 5.4% chance of exploitation in the next 30 days. This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier…
CVE-2025-55039, published 2025-10-15. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication…
CVE-2024-23945, published 2024-12-23. Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days. Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying…
CVE-2023-22946, published 2023-04-17. Critical severity, CVSS 9.9. EPSS: 1.1% chance of exploitation in the next 30 days. In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the…
CVE-2022-31777, published 2022-11-01. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a…
CVE-2021-38296, published 2022-03-10. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication…