dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)

snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in PySpark (CVE-2025-55039)

Summary A deserialization vulnerability in the PySpark component CVE-2025-55039 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.5.8. Vulnerability Details CVEID:CVE-2025-55039 DESCRIPTION: This issue affects Apache Spark versions before 3.4.4...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: GHSA-9437-39HJ-3C93...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: OSV:PYSEC-2026-3966...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: MEND:CVE-2026-32773...

dagster-gcp-pandas (>=0.17.20, <=0.29.0), dagster-gcp-pyspark (>=0.17.21, <=0.29.0) +1 more potentially affected by CVE-2026-41490 via dagster-gcp (>=0.17.20, <=0.29.0)

dagster-gcp PYPI version =0.17.20, =0.17.20, =0.17.21, =0.1.0, =0.1.6 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2435...

dagster-snowflake-pandas (>=0.14.15, <=0.29.0), dagster-snowflake-polars (>=0.27.2, <=0.29.0) +2 more potentially affected by CVE-2026-41490 via dagster-snowflake (>=0.14.15, <=0.29.0)

dagster-snowflake PYPI version =0.14.15, =0.14.15, =0.27.2, =0.17.15, =1.0.0, =1.1.2 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2436...

clarifai (>=9.9.3, <=9.10.4), clarifai-pyspark (>=0.0.1, <=0.0.3) +8 more potentially affected by CVE-2025-71176 via pytest (7.4.1)

pytest PYPI version 7.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - clarifai =9.9.3, =0.0.1, =0.0.1, =0.0.1, =1.0.1, =1.0.7 - webtorchx 0.0.1 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

ROOT-APP-PYPI-CVE-2022-31777 CVE-2022-31777 in pyspark - Patched by Root

Root has patched CVE-2022-31777 in the pyspark package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-22946 CVE-2023-22946 in pyspark - Patched by Root

Root has patched CVE-2023-22946 in the pyspark package for Root:PyPI. Multiple fixed versions available...

ANT-2026-PGRNAV88 · Spark · other

other critical Severity Claude critical · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-PGRNAV88: spark rce UserDefinedType.fromJson in python/pyspark/sql/types.py:2002 passes bytes taken from...

dagster-snowflake-pandas (>=0.14.15, <=0.29.0), dagster-snowflake-polars (>=0.27.2, <=0.29.0) +2 more potentially affected by CVE-2026-41490 via dagster-snowflake (>=0.14.15, <=0.29.0)

dagster-snowflake PYPI version =0.14.15, =0.14.15, =0.27.2, =0.17.15, =1.0.0, =1.1.2 Source cves: CVE-2026-41490 Source advisory: MEND:CVE-2026-41490...

dagster-duckdb-pandas (>=0.17.21, <=0.29.0), dagster-duckdb-polars (>=0.17.21, <=0.29.0) +6 more potentially affected by CVE-2026-41490 via dagster-duckdb (>=0.17.21, <=0.29.0)

dagster-duckdb PYPI version =0.17.21, =0.17.21, =0.17.21, =0.17.21, =0.1.1, =0.1.0, =0.1.0, =0.1.1 - lung-sarg 1.0.0 Source cves: CVE-2026-41490 Source advisory: SNYK:PYTHON-DAGSTERDUCKDB-16109580...

analytics-zoo (>=0.5.0, <=0.10.0), bigdl (>=0.11.0, <=0.13.0.dev0) +4 more potentially affected by CVE-2025-55039 via pyspark (2.4.3)

pyspark PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo =0.5.0, =0.11.0, =0.1.0, =0.1.2, =0.1.8 Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...

analytics-zoo (>=0.11.0, <=0.12.0b2022082301), bigdl (>=0.13.0.dev1, <=2.5.0b20240324) +12 more potentially affected by CVE-2025-55039 via pyspark (2.4.6)

pyspark PYPI version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo =0.11.0, =0.13.0.dev1, =0.14.0b20211027, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =0.3.0, =0.2.1, =0.4.1 Source cves:...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +182 more potentially affected by CVE-2025-55039 via pyspark (>=3.0.0, <=3.4.2)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =0.0.2, =1.0.0, =0.12.0.dev0, =0.14.0.dev2 - bigdl-chronos-spark3 2.0.0 and more Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8...

amsdal (>=0.0.12, <=0.1.16), amsdal-cli (>=0.0.1, <=0.0.23) +57 more potentially affected by CVE-2025-55039 via pyspark (>=3.5.0, <=3.5.1)

pyspark PYPI version =3.5.0, =0.0.12, =0.0.1, =0.0.7, =0.0.1, =1.3.2, =0.13.0, =0.0.1, =1.2.17, =0.0.0, =5.0.0, =5.2.1 and more Source cves: CVE-2025-55039 Source advisory: GHSA-6P6V-M64V-JX8Q...

analytics-zoo (0.2.0), hail (>=0.2.1, <=0.2.12) potentially affected by CVE-2025-55039 via pyspark (2.2.3)

pyspark PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.2.0 - hail =0.2.1, =0.2.12 Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...

pytispark (2.0.0) potentially affected by CVE-2025-55039 via pyspark (2.3.3)

pyspark PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - pytispark 2.0.0 Source cves: CVE-2025-55039 Source advisory: OSV:PYSEC-2025-184...

dataland (>=0.1.2, <=0.1.7), pyrasterframes (>=0.8.0.dev0, <=0.8.3.post0) +1 more potentially affected by CVE-2025-55039 via pyspark (2.3.4)

pyspark PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - dataland =0.1.2, =0.8.0.dev0, =2.3.0, =2.3.0.post7 Source cves: CVE-2025-55039 Source advisory: OSV:PYSEC-2025-184...