Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.spark:spark-core_2.11

10 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.4.8 (May 9, 2021): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
10 · 1 high, 1 medium
Dependents
238
Releases
40 since 1.2.0 (Dec 10, 2014)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-54920
    Affects 1.2.0 to 2.4.8 (through the newest release)
  • CVE-2022-31777
    Affects 1.2.0 to 2.4.8 (through the newest release)
  • CVE-2019-10099
    Affects 1.2.0 to 2.3.2 (2.3.3 is outside it)
  • CVE-2018-17190
    Affects 1.2.0 to 2.4.8 (through the newest release)
  • CVE-2018-11804
    Affects 1.3.0 to 2.1.3 (2.2.0 is outside it)
  • CVE-2018-11770
    Affects 1.2.0 to 2.3.2 (2.3.3 is outside it)
  • CVE-2018-8024
    Affects 2.1.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it); 2.3.0 (2.3.1 is outside it)
  • CVE-2018-1334
    Affects 1.2.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it); 2.3.0 (2.3.1 is outside it)
  • CVE-2017-12612
    Affects 1.2.0 to 2.1.1 (2.1.2 is outside it)
  • CVE-2017-7678
    Affects 1.2.0 to 2.1.3 (2.2.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • Apache Spark: Spark History Server Code Execution Vulnerability

    Affected: through 2.4.8.

    No fix released. The latest release, 2.4.8, is still affected.

  • CVE-2022-31777Medium 5.4

    Apache Spark XSS vulnerability in log viewer UI Javascript

    Affected: all versions.

    No fix released. The latest release, 2.4.8, is still affected.

  • Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.

    Affected: fixed in 2.3.3.

    Fixed in 2.3.3 (released Feb 6, 2019, 182 days before disclosure).

    The latest release, 2.4.8, is not affected.

  • In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on…

    Affected: all versions.

    No fix released. The latest release, 2.4.8, is still affected.

  • Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation.

    Affected: from 1.3.0, through 2.1.3.

    Fixed in 2.2.0 (released Jul 1, 2017, 480 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.4.8, is not affected.

  • From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism…

    Affected: from 1.0.0, through 2.3.2.

    Fixed in 2.3.3 (released Feb 6, 2019, 177 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.4.8, is not affected.

  • In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark…

    Affected: from 2.1.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; from 2.3.0, fixed in 2.3.1.

    Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure), 2.2.2 (released Jun 27, 2018, 15 days before disclosure) and 2.3.1 (released Jun 1, 2018, 41 days before disclosure).

    The latest release, 2.4.8, is not affected.

  • In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to…

    Affected: from 1.0.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; from 2.3.0, fixed in 2.3.1.

    Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure), 2.2.2 (released Jun 27, 2018, 15 days before disclosure) and 2.3.1 (released Jun 1, 2018, 41 days before disclosure).

    The latest release, 2.4.8, is not affected.

  • In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.

    Affected: fixed in 2.1.2.

    Fixed in 2.1.2 (released Oct 3, 2017, 20 days after disclosure).

    The latest release, 2.4.8, is not affected.

  • In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting…

    Affected: fixed in 2.2.0.

    Fixed in 2.2.0 (released Jul 1, 2017, 11 days before disclosure).

    The latest release, 2.4.8, is not affected.