ai.catboost:catboost-spark_3.0_2.12 (>=0.25, <=1.2.8), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +1534 more potentially affected by CVE-2026-32773 via org.apache.spark:spark-core_2.12 (>=3.0.0, <=3.5.7)

org.apache.spark:spark-core2.12 MAVEN version =3.0.0, =0.25, =1.0.1, =1.0.6, =1.1, =1.2, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =thread-pool-0.0.24-dev, =0.0.6,...

ai.grakn:grakn-bootup (>=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, <=1.2.0), ai.grakn:grakn-dist (>=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, <=1.4.1) +447 more potentially affected by CVE-2026-17459 via com.sparkjava:spark-core (>=1.0, <=2.9.4)

com.sparkjava:spark-core MAVEN version =1.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.6.1, =0.7.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.6.1, =0.6.1,...

com.databricks:spark-csv_2.11 (>=1.1.0, <=1.2.0), com.datastax.spark:spark-cassandra-connector-embedded_2.11 (>=1.4.0-m1, <=1.4.0) +23 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.11 (1.4.0)

org.apache.spark:spark-core2.11 MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.11 and may be impacted: - com.databricks:spark-csv2.11 =1.1.0, =1.4.0-m1, =1.4.0-m1, =1.4.0-m1, =1.4.00.7.1, =0.9.0,...

com.couchbase.client:spark-connector_2.11 (>=1.0.0, <=1.0.1), com.datastax.spark:spark-cassandra-connector-embedded_2.11 (>=1.4.1, <=1.4.5) +40 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.11 (1.4.1)

org.apache.spark:spark-core2.11 MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.11 and may be impacted: - com.couchbase.client:spark-connector2.11 =1.0.0, =1.4.1, =1.4.1, =1.4.1, =0.4.0-m3, =0.4.0-m5,...

ai.tripl:arc_2.12 (>=2.13.0, <=2.14.0), ch.cern.sparkmeasure:spark-measure_2.12 (0.17) +49 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.12 (2.4.6)

org.apache.spark:spark-core2.12 MAVEN version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.12 and may be impacted: - ai.tripl:arc2.12 =2.13.0, =1.7.0, =2.5.1, =0.1.11, =0.1.6, =2.4.61.1.0, =2.0.0,...

com.beachape:sparkka-streams_2.11 (>=1.0, <=1.5), com.caffinc.sparktools:mongordd (>=1.0.1, <=1.0.2) +40 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.11 (1.6.0)

org.apache.spark:spark-core2.11 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.11 and may be impacted: - com.beachape:sparkka-streams2.11 =1.0, =1.0.1, =0.1, =0.4.0-m3, =0.4.0-m5, =0.4.0-m1, =1.0.4,...

ai.tripl:arc-cassandra-pipeline-plugin_2.12 (>=1.2.0, <=1.3.0), ai.tripl:arc-dataquality-udf-plugin_2.12 (>=1.2.0, <=1.3.0) +133 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.12 (2.4.5)

org.apache.spark:spark-core2.12 MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.12 and may be impacted: - ai.tripl:arc-cassandra-pipeline-plugin2.12 =1.2.0, =1.2.0, =1.6.0, =1.1.0, =1.1.0, =2.0.0, =1.2.0...

com.azure.cosmos.spark:azure-cosmos-spark_4-0_2-13 (>=4.43.0, <=4.50.0), com.github.rumbledb:rumbledb (2.0.0) +101 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.13 (>=4.0.0, <=4.0.0-preview2)

org.apache.spark:spark-core2.13 MAVEN version =4.0.0, =4.43.0, =0.43.0-preview, =0.43.0-preview, =4.0.02.1.2, =7.0.0-rc1, =0.0.3, =0.0.3, =7.0.1, =4.1.0, =4.1.4 and more Source cves: CVE-2025-54920 Source advisory: OSV:GHSA-JWP6-CVJ8-FW65...

ai.h2o:sparkling-water-core_2.10 (>=0.2.5, <=1.2.6), ai.h2o:sparkling-water-examples_2.10 (>=0.2.5, <=1.2.6) +60 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (1.2.0)

org.apache.spark:spark-core2.10 MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.10 and may be impacted: - ai.h2o:sparkling-water-core2.10 =0.2.5, =0.2.5, =2.8.1, =2.8.1, =0.1, =0.1, =0.4.0-m3, =0.4.0 and...

com.datastax.spark:spark-cassandra-connector-embedded_2.10 (>=1.2.2, <=1.2.6), com.datastax.spark:spark-cassandra-connector-java_2.10 (>=1.2.2, <=1.2.6) +19 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (1.2.2)

org.apache.spark:spark-core2.10 MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.10 and may be impacted: - com.datastax.spark:spark-cassandra-connector-embedded2.10 =1.2.2, =1.2.2, =1.2.2, =0.4.0-m3,...

com.tuplejump:calliope_2.10 (>=0.9.0-c2-ea, <=0.9.0-u1-ea), com.tuplejump:snackfs_2.10 (0.6.1-ea) +13 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (0.9.0-incubating)

org.apache.spark:spark-core2.10 MAVEN version 0.9.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.10 and may be impacted: - com.tuplejump:calliope2.10 =0.9.0-c2-ea, =0.5.0, =0.6.0 -...

org.apache.spark:spark-assembly_2.10 (0.9.2), org.apache.spark:spark-bagel_2.10 (0.9.2) +10 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (0.9.2)

org.apache.spark:spark-core2.10 MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.10 and may be impacted: - org.apache.spark:spark-assembly2.10 0.9.2 - org.apache.spark:spark-bagel2.10 0.9.2 -...

co.cask.cdap:cdap-client-tests (>=3.3.0, <=3.3.7), co.cask.cdap:loganalysis (>=3.1.0, <=3.3.7) +48 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (1.3.1)

org.apache.spark:spark-core2.10 MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.10 and may be impacted: - co.cask.cdap:cdap-client-tests =3.3.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =0.9.9.12, =1.3.0-m1,...

ch.zzeekk.spark:spark-temporalquery_2.10 (1.0.0), com.antgroup.tugraph:calcite-spark (>=1.18.0-geaflow_1.0, <=1.18.0-geaflow_1.1) +159 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.10 (>=2.0.0, <=2.2.3)

org.apache.spark:spark-core2.10 MAVEN version =2.0.0, =1.18.0-geaflow1.0, =0.1.0, =2.0.0, =0.8.2, =1.1.0, =2.0.0-m1, =2.0.0-m3, =2.0.0-m1, =2.0.13 and more Source cves: CVE-2025-54920 Source advisory: OSV:GHSA-JWP6-CVJ8-FW65...

com.holdenkarau:spark-testing-base_2.13 (4.0.0-preview2_2.0.1), com.stabrise:common-spark-pdf-spark40_2.13 (>=0.1.15, <=0.1.17) +26 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.13 (>=4.0.0-preview1, <=4.0.0-preview2)

org.apache.spark:spark-core2.13 MAVEN version =4.0.0-preview1, =0.1.15, =0.1.11, =0.1.11, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview1, =4.0.0-preview2 and more Source cves: CVE-2025-54920 Source advisory:...

ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.3_2.13 (>=1.1.1, <=1.2.10) +486 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.13 (>=3.2.0, <=3.5.6)

org.apache.spark:spark-core2.13 MAVEN version =3.2.0, =1.0.6, =1.1.1, =1.2, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.0.14, =6.5.0, =1.3.3, =0.1.0, =0.20, =0.2, =0.4 - ch.zzeekk.spark:spark-temporalquery2.13 3.0....

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Jackson implementation in the Spark History Server web UI. An attacker who can write event logs can achieve code execution by injecting malicious JSON payloads into event log files, which are the...

Deserialization of Untrusted Data

Overview org.apache.spark:spark-core2.12 is an unified analytics engine for large-scale data processing. It provides high-level APIs in Scala, Java, Python, and R, and an optimized engine that supports general computation graphs for data analysis. It also supports a rich set of higher-level tools...

Improper Privilege Management

spark-core is vulnerable to Improper Privilege Management . The vulnerability exists because the library does not properly disallow arbitrary custom classpaths with the proxy user in cluster mode, which allows an attacker to provide malicious configuration-related classes in the classpath...

ai.catboost:catboost-spark_2.4_2.12 (>=0.25, <=1.2.7), com.crealytics:spark-excel-2.12.17-2.4.1_2.12 (>=2.4.1_0.18.1-beta3, <=2.4.1_0.18.1) +28 more potentially affected by CVE-2023-22946 via org.apache.spark:spark-core_2.12 (2.4.1)

org.apache.spark:spark-core2.12 MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.12 and may be impacted: - ai.catboost:catboost-spark2.42.12 =0.25, =2.4.10.18.1-beta3, =2.4.10.18.2, =1.0.13, =0.2.5-2.4.1,...