Read the docs
TI-2018-08458 Aliases CVE-2018-11804GHSA-62g2-m955-v383

Improper input validation in Apache Spark

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.

Why it matters now

EPSS 0.05696 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark1.3.0 and later—No fix listedCNA
—org.apache.spark:spark-core_2.11 (Maven)1.3.0 – 2.1.3—No fix listedGHSA-62g2-m955-v383
—org.apache.spark:spark-core_2.10 (Maven)1.3.0 – 2.1.3—No fix listedGHSA-62g2-m955-v383
  • Apache Spark VendorApache Affected 1.3.0 and later Fixed in — No fix listed CNA
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected 1.3.0 – 2.1.3 Fixed in — No fix listed GHSA-62g2-m955-v383
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected 1.3.0 – 2.1.3 Fixed in — No fix listed GHSA-62g2-m955-v383

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*1.3.0 to before 2.2.3; 2.3.0 to before 2.3.3VulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions 1.3.0 to before 2.2.3; 2.3.0 to before 2.3.3 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11804
  2. 2026-10-03 Alias added: GHSA-62g2-m955-v383

References

Advisory 3

Other 3

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences