CVE-2025-55039 json
Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
published 2025-10-15 12 mo ago modified 2026-10-08 32 d ago also EUVD-2025-34531 , GHSA-6p6v-m64v-jx8q , PYSEC-2025-184
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.
Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.
When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.
This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.
To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or
enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
Patch / fix
- maven org.apache.spark:spark-network-common_2.13 3.4.4, 3.5.2
- maven org.apache.spark:spark-network-common_2.12 3.4.4, 3.5.2
- pypi pyspark 3.4.4, 3.5.2
- Apache Software Foundation Apache Spark 3.4.4, 3.5.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.spark:spark-network-common_2.13 | >=3.5.0, <3.5.2 <3.4.4 |
3.5.2 3.4.4 |
| maven | org.apache.spark:spark-network-common_2.12 | <3.4.4 >=3.5.0, <3.5.2 |
3.4.4 3.5.2 |
| pypi | pyspark | <3.4.4 >=3.5.0, <3.5.2 |
3.4.4 3.5.2 |
Affected products
- Apache Software Foundation Apache Spark
Classification
References
-
github.com
/apache/spark/commit/05ba74e5f8043601b7af530429ceaf828d7bb329
web
-
github.com
/apache/spark/commit/405b23b1aef889fad03bf4e3ced6d427dc9a43f4
web
-
github.com
/apache/spark/commit/f0563ef64c7f42df21b16ccaeb4cf1324ea720f9
web
-
lists.apache.org
/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2025/10/14/11
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-55039
advisory
-
github.com
/apache/spark
package
-
github.com
/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2025-184.yaml
web
-
issues.apache.org
/jira/browse/SPARK-47172
web
-
github.com
/advisories/GHSA-6p6v-m64v-jx8q
advisory
Sources
- CVE List CVE-2025-55039
- GitHub Advisory GHSA-6p6v-m64v-jx8q
- NVD CVE-2025-55039
- OSV PYSEC-2025-184
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.