CVE-2017-7678

CVE-2017-7678 affects Apache Spark up to version 2.2.0, where the web UI may reflect user-supplied data (including MHTML) back to the user. The root cause is improper validation of input by the Spark web UI, allowing an attacker to lure a user into a link pointing to a shared Spark cluster and tr...

CVE-2025-55039

CVE-2025-55039 affects Apache Spark prior to 3.4.4, 3.5.2 and 4.0.0. When spark.network.crypto.enabled is true (default false) and spark.network.crypto.cipher is not configured, Spark uses AES/CTR/NoPadding for RPC traffic, enabling encryption without authentication. A MITM could flip bits in cip...

CVE-2026-32773

Apache Spark History Server (web UI) is vulnerable to a cross-site scripting (XSS) flaw caused by insufficient output escaping prior to version 3.5.8 . A user with the ability to launch a Spark job can inject arbitrary unescaped frontend code into the history server's web pages, leading to a mini...