Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pyspark

12 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
4.3.0 (Oct 30, 2026): no advisory affects it
Newest unaffected release
4.3.0 (Oct 30, 2026), the latest release
Advisories
12 · 2 high, 4 medium
Weekly downloads
11.2M
Dependents
633
Releases
77 since 2.1.2 (Oct 25, 2017)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-32773
    Affects 3.0.0 to 3.5.7 (3.5.8 is outside it)
  • CVE-2025-55039
    Affects 2.1.2 to 3.4.3 (3.4.4 is outside it); 3.5.0 to 3.5.1 (3.5.2 is outside it)
  • CVE-2023-32007
    Affects 2.1.2 to 3.2.1 (3.2.2 is outside it)
  • CVE-2023-22946
    Affects 2.1.2 to 3.3.4 (3.4.0 is outside it)
  • CVE-2022-31777
    Affects 2.1.2 to 3.2.1 (3.2.2 is outside it); 3.3.0 (3.3.1 is outside it)
  • CVE-2022-33891
    Affects 2.1.2 to 3.1.2 (3.1.3 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it)
  • CVE-2021-38296
    Affects 2.1.2 to 3.1.2 (3.1.3 is outside it)
  • CVE-2020-9480
    Affects 2.1.2 to 2.4.5 (2.4.6 is outside it)
  • CVE-2019-10099
    Affects 2.1.2 to 2.3.2 (2.3.3 is outside it)
  • CVE-2018-11760
    Affects 2.1.2 to 2.2.2 (2.2.3 is outside it); 2.3.0 to 2.3.1 (2.3.2 is outside it)
  • CVE-2018-1334
    Affects 2.1.2 (2.1.3 is outside it); 2.2.0.post0 to 2.2.1 (2.2.2 is outside it)
  • CVE-2017-12612
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • CVE-2026-32773Medium 6.1

    Apache Spark: XSS Vulnerability in Spark Web 3.5.4

    Affected: from 3.0.0, fixed in 3.5.8.

    Fixed in 3.5.8 (released Jan 15, 2026, 230 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • CVE-2025-55039Medium 6.5

    Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification…

    Affected: fixed in 3.4.4; from 3.5.0, fixed in 3.5.2; fixed in 3.4.4; from 3.5.0, fixed in 3.5.2.

    Fixed in 3.4.4 (released Oct 25, 2024, 355 days before disclosure) and 3.5.2 (released Aug 12, 2024, 429 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • Apache Spark: Shell command injection via Spark UI

    Affected: fixed in 3.2.2; from 3.1.1, fixed in 3.2.2.

    Fixed in 3.2.2 (released Jul 15, 2022, 291 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • CVE-2023-22946Medium 6.4

    Apache Spark proxy-user privilege escalation from malicious configuration class

    Affected: fixed in 3.3.2; fixed in 3.4.0.

    Fixed in 3.4.0 (released Apr 13, 2023, 4 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • CVE-2022-31777Medium 5.4

    Apache Spark XSS vulnerability in log viewer UI Javascript

    Affected: fixed in 3.2.2; from 3.3.0, fixed in 3.3.1.

    Fixed in 3.2.2 (released Jul 15, 2022, 109 days before disclosure) and 3.3.1 (released Oct 25, 2022, 7 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • CVE-2022-33891High 8.8 · KEV

    Apache Spark shell command injection vulnerability via Spark UI

    Affected: fixed in 3.1.3; from 3.2.0, fixed in 3.2.2; fixed in 3.1.3; from 3.2.0, fixed in 3.2.2.

    Fixed in 3.1.3 (released Feb 18, 2022, 150 days before disclosure) and 3.2.2 (released Jul 15, 2022, 3 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • Apache Spark Key Negotiation Vulnerability

    Affected: fixed in 3.1.3.

    Fixed in 3.1.3 (released Feb 18, 2022, 20 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate)…

    Affected: fixed in 2.4.6.

    Fixed in 2.4.6 (released Jun 6, 2020, 17 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.

    Affected: fixed in 2.3.3.

    Fixed in 2.3.3 (released Feb 15, 2019, 173 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the…

    Affected: from 2.3.0, fixed in 2.3.2; from 1.0.2, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 1.0.2, fixed in 2.2.3.

    Fixed in 2.2.3 (released Jan 13, 2019, 22 days before disclosure) and 2.3.2 (released Sep 25, 2018, 132 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to…

    Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; fixed in 2.1.3.

    Fixed in 2.1.3 (released Jun 29, 2018, 13 days before disclosure) and 2.2.2 (released Jul 3, 2018, 9 days before disclosure).

    The latest release, 4.3.0, is not affected.

  • In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket.

    Affected: fixed in 2.1.2.

    Fixed in 2.1.2 (released Oct 25, 2017, 42 days after disclosure).

    The latest release, 4.3.0, is not affected.