Skip to content
OpenAdvisories

Package · Maven

org.apache.spark:spark-network-common_2.13

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 6.5
    CVE-2025-55039

    Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks

    This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true…

    Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-network-common_2.12 Maven PyPI