CVE-2022-33891

Summary: CVE-2022-33891 is a command-injection vulnerability in the Apache Spark UI when ACLs are enabled. A code path in HttpSecurityFilter can impersonate by supplying an arbitrary username, leading to an arbitrary shell command being executed as the Spark process user. Affected versions includ...

CVE-2023-32007

CVE-2023-32007 describes a command injection in the Apache Spark UI when ACLs are enabled via spark.acls.enable. A path in HttpSecurityFilter could allow impersonation by supplying an arbitrary username, enabling a permission check to build and execute a Unix shell command as the Spark process us...

CVE-2025-54920

The CVE-2025-54920 entry describes a code execution vulnerability in Apache Spark prior to 3.5.7 and 4.0.1, originating from the Spark History Server’s oversized Jackson deserialization of event log data. The issue uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListe...