CVE-2025-55039mediumCWE-326CWE-347

CVE-2025-55039: medium-severity vulnerability in Apache Spark

Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks

Published · Updated

Follow this CVE+ Monitor Apache Spark+ Monitor pyspark

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.2%
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Spark
Related CVEs — Apache Spark

In the same product, most dangerous first.

CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.2%KEVCVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2018-11770—CVE-2018-11770EPSS 66.1%CVE-2020-9480—CVE-2020-9480EPSS 29.4%CVE-2018-17190—CVE-2018-17190EPSS 8.8%CVE-2018-11804—CVE-2018-11804EPSS 5.7%