Improper signature verification in Apache Spark
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-326 and CWE-347.
Summary
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Spark | 3.5.0 to before 3.5.2; before 3.4.4 | 3.5.2, 3.4.4 | Patch available | CNA |
| Apache | Apache Spark | 3.5.0 to before 3.5.2; before 3.4.4 | 3.5.2, 3.4.4 | Patch available | CNA |
| — | org.apache.spark:spark-network-common_2.13 (Maven) | 3.5.0 to before 3.5.2 | 3.5.2 | Patch available | GHSA-6p6v-m64v-jx8q |
| — | org.apache.spark:spark-network-common_2.13 (Maven) | before 3.4.4 | 3.4.4 | Patch available | GHSA-6p6v-m64v-jx8q |
| — | org.apache.spark:spark-network-common_2.12 (Maven) | before 3.4.4 | 3.4.4 | Patch available | GHSA-6p6v-m64v-jx8q |
| — | org.apache.spark:spark-network-common_2.12 (Maven) | 3.5.0 to before 3.5.2 | 3.5.2 | Patch available | GHSA-6p6v-m64v-jx8q |
| — | pyspark (PyPI) | before 3.4.4 | 3.4.4 | Patch available | GHSA-6p6v-m64v-jx8q |
| — | pyspark (PyPI) | 3.5.0 to before 3.5.2 | 3.5.2 | Patch available | GHSA-6p6v-m64v-jx8q |
- Apache Spark VendorApache Affected 3.5.0 to before 3.5.2; before 3.4.4 Fixed in 3.5.2, 3.4.4 Patch available CNA
- Apache Spark VendorApache Affected 3.5.0 to before 3.5.2; before 3.4.4 Fixed in 3.5.2, 3.4.4 Patch available CNA
- org.apache.spark:spark-network-common_2.13 (Maven) Vendor— Affected 3.5.0 to before 3.5.2 Fixed in 3.5.2 Patch available GHSA-6p6v-m64v-jx8q
- org.apache.spark:spark-network-common_2.13 (Maven) Vendor— Affected before 3.4.4 Fixed in 3.4.4 Patch available GHSA-6p6v-m64v-jx8q
- org.apache.spark:spark-network-common_2.12 (Maven) Vendor— Affected before 3.4.4 Fixed in 3.4.4 Patch available GHSA-6p6v-m64v-jx8q
- org.apache.spark:spark-network-common_2.12 (Maven) Vendor— Affected 3.5.0 to before 3.5.2 Fixed in 3.5.2 Patch available GHSA-6p6v-m64v-jx8q
- pyspark (PyPI) Vendor— Affected before 3.4.4 Fixed in 3.4.4 Patch available GHSA-6p6v-m64v-jx8q
- pyspark (PyPI) Vendor— Affected 3.5.0 to before 3.5.2 Fixed in 3.5.2 Patch available GHSA-6p6v-m64v-jx8q
Remediation
- Fix · CNA Apache Spark (Apache Software Foundation) Fixed in 3.5.2, 3.4.4
- Fix · CNA Apache Spark (Apache Software Foundation) Fixed in 3.5.2, 3.4.4
- Fix · GHSA-6p6v-m64v-jx8q org.apache.spark:spark-network-common_2.13 (Maven) Fixed in 3.5.2 Advisory →
- Fix · GHSA-6p6v-m64v-jx8q org.apache.spark:spark-network-common_2.13 (Maven) Fixed in 3.4.4 Advisory →
- Fix · GHSA-6p6v-m64v-jx8q org.apache.spark:spark-network-common_2.12 (Maven) Fixed in 3.4.4 Advisory →
- Fix · GHSA-6p6v-m64v-jx8q org.apache.spark:spark-network-common_2.12 (Maven) Fixed in 3.5.2 Advisory →
- Fix · GHSA-6p6v-m64v-jx8q pyspark (PyPI) Fixed in 3.4.4 Advisory →
- Fix · GHSA-6p6v-m64v-jx8q pyspark (PyPI) Fixed in 3.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55039
- 2026-10-03 Alias added: GHSA-6p6v-m64v-jx8q
References
Advisory 2
Other 7
- https://github.com/apache/spark/commit/05ba74e5f8043601b7af530429ceaf828d7bb329
- https://github.com/apache/spark/commit/405b23b1aef889fad03bf4e3ced6d427dc9a43f4
- https://github.com/apache/spark/commit/f0563ef64c7f42df21b16ccaeb4cf1324ea720f9
- https://github.com/apache/spark
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2025-184.yaml
- https://issues.apache.org/jira/browse/SPARK-47172
- http://www.openwall.com/lists/oss-security/2025/10/14/11
More Apache Spark vulnerabilities
- TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
- TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
- TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
- TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
- TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
- TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
Sources
- CVE-2025-55039 · CVE Program
- CVE-2025-55039 · NVD
- FIRST EPSS
- GHSA-6p6v-m64v-jx8q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences