MavenPackage

org.apache.spark:spark-core_2.10

9 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 2.2.3 (Jan 8, 2019): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 9 · 1 high, 1 medium

Dependents: 48
Releases: 34 since 0.9.0-incubating (Jan 24, 2014)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-54920
Affects 0.9.0-incubating to 2.2.3 (through the newest release)
CVE-2022-31777
Affects 0.9.0-incubating to 2.2.3 (through the newest release)
CVE-2018-17190
Affects 0.9.0-incubating to 2.2.3 (through the newest release)
CVE-2018-11804
Affects 1.3.0 to 2.1.3 (2.2.0 is outside it)
CVE-2018-11770
Affects 1.0.0 to 2.2.2 (2.2.3 is outside it)
CVE-2018-8024
Affects 2.1.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2018-1334
Affects 1.0.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2017-12612
Affects 0.9.0-incubating to 2.1.1 (2.1.2 is outside it)
CVE-2017-7678
Affects 0.9.0-incubating to 2.1.3 (2.2.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2025-54920High 8.8
Apache Spark: Spark History Server Code Execution Vulnerability
Affected: through 2.2.3.
No fix released. The latest release, 2.2.3, is still affected.
CVE-2022-31777Medium 5.4
Apache Spark XSS vulnerability in log viewer UI Javascript
Affected: all versions.
No fix released. The latest release, 2.2.3, is still affected.
CVE-2018-17190Unrated
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on…
Affected: all versions.
No fix released. The latest release, 2.2.3, is still affected.
CVE-2018-11804Unrated
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation.
Affected: from 1.3.0, through 2.1.3.
Fixed in 2.2.0 (released Jul 1, 2017, 480 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.2.3, is not affected.
CVE-2018-11770Unrated
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism…
Affected: from 1.0.0, through 2.2.2.
Fixed in 2.2.3 (released Jan 8, 2019, 148 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.2.3, is not affected.
CVE-2018-8024Unrated
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark…
Affected: from 2.1.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2.
Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure) and 2.2.2 (released Jun 27, 2018, 15 days before disclosure).
The latest release, 2.2.3, is not affected.
CVE-2018-1334Unrated
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to…
Affected: from 1.0.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2.
Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure) and 2.2.2 (released Jun 27, 2018, 15 days before disclosure).
The latest release, 2.2.3, is not affected.
CVE-2017-12612Unrated
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.
Affected: fixed in 2.1.2.
Fixed in 2.1.2 (released Oct 3, 2017, 20 days after disclosure).
The latest release, 2.2.3, is not affected.
CVE-2017-7678Unrated
In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting…
Affected: fixed in 2.2.0.
Fixed in 2.2.0 (released Jul 1, 2017, 11 days before disclosure).
The latest release, 2.2.3, is not affected.