# pyspark (PyPI) vulnerabilities 12 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.3.0 (Oct 30, 2026): no advisory affects it - Newest unaffected release: 4.3.0 (Oct 30, 2026), the latest release - Weekly downloads: 11.2M - Dependents: 633 - Releases: 77 since 2.1.2 (Oct 25, 2017) - Registry: https://pypi.org/project/pyspark/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-32773: 3.0.0 to 3.5.7 (3.5.8 is outside it) - CVE-2025-55039: 2.1.2 to 3.4.3 (3.4.4 is outside it); 3.5.0 to 3.5.1 (3.5.2 is outside it) - CVE-2023-32007: 2.1.2 to 3.2.1 (3.2.2 is outside it) - CVE-2023-22946: 2.1.2 to 3.3.4 (3.4.0 is outside it) - CVE-2022-31777: 2.1.2 to 3.2.1 (3.2.2 is outside it); 3.3.0 (3.3.1 is outside it) - CVE-2022-33891: 2.1.2 to 3.1.2 (3.1.3 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it) - CVE-2021-38296: 2.1.2 to 3.1.2 (3.1.3 is outside it) - CVE-2020-9480: 2.1.2 to 2.4.5 (2.4.6 is outside it) - CVE-2019-10099: 2.1.2 to 2.3.2 (2.3.3 is outside it) - CVE-2018-11760: 2.1.2 to 2.2.2 (2.2.3 is outside it); 2.3.0 to 2.3.1 (2.3.2 is outside it) - CVE-2018-1334: 2.1.2 (2.1.3 is outside it); 2.2.0.post0 to 2.2.1 (2.2.2 is outside it) - CVE-2017-12612: no published release is affected ## Advisories (12) ### [CVE-2026-32773](https://cve.now/CVE-2026-32773): Apache Spark: XSS Vulnerability in Spark Web 3.5.4 - Severity: Medium 6.1 - Published: Sep 2, 2026 - Affected: from 3.0.0, fixed in 3.5.8. - Fixed in 3.5.8 (released Jan 15, 2026, 230 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2025-55039](https://cve.now/CVE-2025-55039): Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification… - Severity: Medium 6.5 - Published: Oct 15, 2025 - Affected: fixed in 3.4.4; from 3.5.0, fixed in 3.5.2; fixed in 3.4.4; from 3.5.0, fixed in 3.5.2. - Fixed in 3.4.4 (released Oct 25, 2024, 355 days before disclosure) and 3.5.2 (released Aug 12, 2024, 429 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2023-32007](https://cve.now/CVE-2023-32007): Apache Spark: Shell command injection via Spark UI - Severity: High 8.8 - Published: May 2, 2023 - Affected: fixed in 3.2.2; from 3.1.1, fixed in 3.2.2. - Fixed in 3.2.2 (released Jul 15, 2022, 291 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2023-22946](https://cve.now/CVE-2023-22946): Apache Spark proxy-user privilege escalation from malicious configuration class - Severity: Medium 6.4 - Published: Apr 17, 2023 - Affected: fixed in 3.3.2; fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 13, 2023, 4 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2022-31777](https://cve.now/CVE-2022-31777): Apache Spark XSS vulnerability in log viewer UI Javascript - Severity: Medium 5.4 - Published: Nov 1, 2022 - Affected: fixed in 3.2.2; from 3.3.0, fixed in 3.3.1. - Fixed in 3.2.2 (released Jul 15, 2022, 109 days before disclosure) and 3.3.1 (released Oct 25, 2022, 7 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2022-33891](https://cve.now/CVE-2022-33891): Apache Spark shell command injection vulnerability via Spark UI - Severity: High 8.8 · KEV - Published: Jul 18, 2022 - Affected: fixed in 3.1.3; from 3.2.0, fixed in 3.2.2; fixed in 3.1.3; from 3.2.0, fixed in 3.2.2. - Fixed in 3.1.3 (released Feb 18, 2022, 150 days before disclosure) and 3.2.2 (released Jul 15, 2022, 3 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2021-38296](https://cve.now/CVE-2021-38296): Apache Spark Key Negotiation Vulnerability - Severity: Unrated - Published: Mar 10, 2022 - Affected: fixed in 3.1.3. - Fixed in 3.1.3 (released Feb 18, 2022, 20 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2020-9480](https://cve.now/CVE-2020-9480): In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate)… - Severity: Unrated - Published: Jun 23, 2020 - Affected: fixed in 2.4.6. - Fixed in 2.4.6 (released Jun 6, 2020, 17 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2019-10099](https://cve.now/CVE-2019-10099): Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. - Severity: Unrated - Published: Aug 7, 2019 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Feb 15, 2019, 173 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2018-11760](https://cve.now/CVE-2018-11760): When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the… - Severity: Unrated - Published: Feb 4, 2019 - Affected: from 2.3.0, fixed in 2.3.2; from 1.0.2, fixed in 2.2.3; from 2.3.0, fixed in 2.3.2; from 1.0.2, fixed in 2.2.3. - Fixed in 2.2.3 (released Jan 13, 2019, 22 days before disclosure) and 2.3.2 (released Sep 25, 2018, 132 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2018-1334](https://cve.now/CVE-2018-1334): In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to… - Severity: Unrated - Published: Jul 12, 2018 - Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.1.3; from 2.2.0, fixed in 2.2.2; fixed in 2.1.3. - Fixed in 2.1.3 (released Jun 29, 2018, 13 days before disclosure) and 2.2.2 (released Jul 3, 2018, 9 days before disclosure). - The latest release, 4.3.0, is not affected. ### [CVE-2017-12612](https://cve.now/CVE-2017-12612): In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. - Severity: Unrated - Published: Sep 13, 2017 - Affected: fixed in 2.1.2. - Fixed in 2.1.2 (released Oct 25, 2017, 42 days after disclosure). - The latest release, 4.3.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pyspark Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.