High [CVE-2025-54920] Apache Spark: This issue affects Apache Spark: before 3.5.7 and 4.0.1.
This high-severity Apache Software Foundation advisory covers CVE-2025-54920 affecting Apache Spark, Spark, Hive.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue.
Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data.
This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server.
The vulnerability arises because the Spark History Server uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating unintended classes, such as org.apache.hive.jdbc.
HiveConnection, which can perform network calls or other malicious actions during deserialization.
The attacker can exploit this by injecting crafted JSON content into the Spark event log files, which the History Server then deserializes on startup or when loading event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote attacker-controlled server, demonstrating remote command injection capability.
Proof of Concept:
1.
- 3.5.7
- 4.0.1
- 3.5.4
Official advisory · high-confidence parse· fetched 4 months ago·verify at source
- 3.5.7
- 4.0.1
Official advisory · high-confidence parse· fetched 4 months ago·verify at source
Mitigation
Upgrade to a fixed release: 3.5.7, 4.0.1. That is the remediation for this advisory.
The vendor advisory may list interim mitigations or workarounds not captured here. Review it before change work.
Official advisory · high-confidence parse· fetched 4 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2025-60012Mar 13, 2026Apache Livy: Malicious configuration can lead to unauthorized file access in Apache Livy.
- CVE-2026-32773Sep 2, 2026There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
- CVE-2026-115721Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all
- CVE-2026-90885Oct 26, 2026Apache Camel Saxon XXE
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.