MAL-2026-16538 Malicious code in spark-rpc (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in spark-rpc (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-55039 Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...

CVE-2025-55039

Apache Spark versions before 3.4.4 , 3.5.2 , and 4.0.0 are vulnerable to a cryptographic issue where they use an insecure default network encryption cipher (AES/CTR/NoPadding ) for inter-node RPC communication when spark.network.crypto.enabled is set to true without an explicit cipher configurati...