Pyspark
11 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Pyspark, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Pyspark CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 1 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 11 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High5
- Medium5
Latest CVEs
The 11 most recently published vulnerabilities affecting Pyspark.
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks6.5
- CVE-2023-32007Apache Spark: Shell command injection via Spark UI8.8
- CVE-2023-22946Apache Spark proxy-user privilege escalation from malicious configuration class6.4
- CVE-2022-31777Apache Spark XSS vulnerability in log viewer UI Javascript5.4
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UI8.8
- CVE-2021-38296Apache Spark Key Negotiation Vulnerability7.5
- CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-cr...9.8
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (co...7.5
- CVE-2018-11760When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2....5.5
- CVE-2018-1334In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user runnin...4.7
- CVE-2017-12612In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentia...7.8
Product grouping is registry-driven, with AI assist and human review. How it works