# org.apache.spark:spark-core\_2.11 (Maven) vulnerabilities 10 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.4.8 (May 9, 2021): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 238 - Releases: 40 since 1.2.0 (Dec 10, 2014) - Registry: https://central.sonatype.com/artifact/org.apache.spark/spark-core_2.11 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-54920: 1.2.0 to 2.4.8 (through the newest release) - CVE-2022-31777: 1.2.0 to 2.4.8 (through the newest release) - CVE-2019-10099: 1.2.0 to 2.3.2 (2.3.3 is outside it) - CVE-2018-17190: 1.2.0 to 2.4.8 (through the newest release) - CVE-2018-11804: 1.3.0 to 2.1.3 (2.2.0 is outside it) - CVE-2018-11770: 1.2.0 to 2.3.2 (2.3.3 is outside it) - CVE-2018-8024: 2.1.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it); 2.3.0 (2.3.1 is outside it) - CVE-2018-1334: 1.2.0 to 2.1.2 (2.1.3 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it); 2.3.0 (2.3.1 is outside it) - CVE-2017-12612: 1.2.0 to 2.1.1 (2.1.2 is outside it) - CVE-2017-7678: 1.2.0 to 2.1.3 (2.2.0 is outside it) ## Advisories (10) ### [CVE-2025-54920](https://cve.now/CVE-2025-54920): Apache Spark: Spark History Server Code Execution Vulnerability - Severity: High 8.8 - Published: Mar 14, 2026 - Affected: through 2.4.8. - No fix released. The latest release, 2.4.8, is still affected. ### [CVE-2022-31777](https://cve.now/CVE-2022-31777): Apache Spark XSS vulnerability in log viewer UI Javascript - Severity: Medium 5.4 - Published: Nov 1, 2022 - Affected: all versions. - No fix released. The latest release, 2.4.8, is still affected. ### [CVE-2019-10099](https://cve.now/CVE-2019-10099): Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. - Severity: Unrated - Published: Aug 7, 2019 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Feb 6, 2019, 182 days before disclosure). - The latest release, 2.4.8, is not affected. ### [CVE-2018-17190](https://cve.now/CVE-2018-17190): In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on… - Severity: Unrated - Published: Nov 19, 2018 - Affected: all versions. - No fix released. The latest release, 2.4.8, is still affected. ### [CVE-2018-11804](https://cve.now/CVE-2018-11804): Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. - Severity: Unrated - Published: Oct 24, 2018 - Affected: from 1.3.0, through 2.1.3. - Fixed in 2.2.0 (released Jul 1, 2017, 480 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.4.8, is not affected. ### [CVE-2018-11770](https://cve.now/CVE-2018-11770): From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism… - Severity: Unrated - Published: Aug 13, 2018 - Affected: from 1.0.0, through 2.3.2. - Fixed in 2.3.3 (released Feb 6, 2019, 177 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.4.8, is not affected. ### [CVE-2018-8024](https://cve.now/CVE-2018-8024): In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark… - Severity: Unrated - Published: Jul 12, 2018 - Affected: from 2.1.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; from 2.3.0, fixed in 2.3.1. - Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure), 2.2.2 (released Jun 27, 2018, 15 days before disclosure) and 2.3.1 (released Jun 1, 2018, 41 days before disclosure). - The latest release, 2.4.8, is not affected. ### [CVE-2018-1334](https://cve.now/CVE-2018-1334): In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to… - Severity: Unrated - Published: Jul 12, 2018 - Affected: from 1.0.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; from 2.3.0, fixed in 2.3.1. - Fixed in 2.1.3 (released Jun 26, 2018, 16 days before disclosure), 2.2.2 (released Jun 27, 2018, 15 days before disclosure) and 2.3.1 (released Jun 1, 2018, 41 days before disclosure). - The latest release, 2.4.8, is not affected. ### [CVE-2017-12612](https://cve.now/CVE-2017-12612): In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. - Severity: Unrated - Published: Sep 13, 2017 - Affected: fixed in 2.1.2. - Fixed in 2.1.2 (released Oct 3, 2017, 20 days after disclosure). - The latest release, 2.4.8, is not affected. ### [CVE-2017-7678](https://cve.now/CVE-2017-7678): In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting… - Severity: Unrated - Published: Jul 12, 2017 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released Jul 1, 2017, 11 days before disclosure). - The latest release, 2.4.8, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.spark:spark-core_2.11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.