Apache Spark 代码问题漏洞

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

PT-2026-25504

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson...

EUVD-2025-208637

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation when processing arbitrary Spark configuration values in requests. An attacker can gain unauthorized access to files by sending specially crafted requests to the REST or JDBC interface. Note: This is only...

GHSA-HM8X-RPGG-7855 Apache Livy: Restrict file access

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

Apache Livy: Restrict file access

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

CVE-2025-60012

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

CVE-2025-60012

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

CVE-2025-60012

CVE-2025-60012 (Apache Livy) : A vulnerability affecting Livy 0.7.0–0.8.0 when connected to Spark 3.1+, enabling unauthorized local file access via crafted Spark configuration values. Root causes (in vulnerable versions): (1) missing validation for spark.archives not added to Livy’s hardcoded fil...

CVE-2025-60012 Apache Livy: Restrict file access

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

CVE-2025-60012 Apache Livy: Restrict file access

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

CVE-2025-60012

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to...

Apache Livy 输入验证错误漏洞

Apache Livy is the United States Apache Apache Foundation, an application server . Provides support for programmatic , fault-tolerant , multi-tenant submission of Spark jobs from Web, mobile applications . Apache Livy suffers from an input validation error vulnerability. The vulnerability stems...

GHSA-7XRH-HQFC-G7QR vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-activemq-artemis, strimzi-kafka-operator, zookeeper, apache-pulsar, apache-nifi, spark, solr, akhq, trino...

CVE-2026-24281 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-activemq-artemis, strimzi-kafka-operator, zookeeper, apache-pulsar, apache-nifi, spark, solr, akhq, trino...

GHSA-7XRH-HQFC-G7QR vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-pulsar-fips, zookeeper, apache-activemq-artemis, strimzi-kafka-operator, trino, zookeeper-fips, apache-pulsar, spark-kubernetes-operator, spark-fips, wso2is, seata, spark-kubernetes-operator-fips, kafka, apache-nifi, akhq, spark, solr...

CVE-2026-24281 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-pulsar-fips, zookeeper, apache-activemq-artemis, strimzi-kafka-operator, trino, zookeeper-fips, apache-pulsar, spark-kubernetes-operator, spark-fips, wso2is, seata, spark-kubernetes-operator-fips, kafka, apache-nifi, akhq, spark, solr...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: prometheus, azure-ipam, gogatekeeper, step-ca, nats-top, spqr, crossplane-provider-aws-ec2, nri-redis, bank-vaults, newrelic-k8s-metadata-injection, nginx-prometheus-exporter, kyverno-policy-reporter, kyverno, terraform-provider-tls, gitlab-kas, php-fpmexporter,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: prometheus, azure-ipam, gogatekeeper, step-ca, nats-top, spqr, crossplane-provider-aws-ec2, nri-redis, bank-vaults, newrelic-k8s-metadata-injection, nginx-prometheus-exporter, kyverno-policy-reporter, kyverno, terraform-provider-tls, gitlab-kas, php-fpmexporter,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: prometheus, azure-ipam, gogatekeeper, step-ca, nats-top, spqr, crossplane-provider-aws-ec2, nri-redis, bank-vaults, newrelic-k8s-metadata-injection, nginx-prometheus-exporter, kyverno-policy-reporter, kyverno, terraform-provider-tls, gitlab-kas, php-fpmexporter,...