CVE-2025-55039: Apache Spark Inadequate Encryption Strength in RPC Communication

CVE-2025-55039 · Severity: medium · CVSS 6.5 · Published 2025-10-15

Apache Spark, a popular data processing engine, uses a weak default encryption method for communication between its internal components when encryption is enabled. This flaw could allow an attacker on the same network to intercept and modify data or system messages without being detected. Such an attack could lead to the corruption of data processing tasks or the disruption of Spark operations.

Technologies: pyspark (PyPI). Vendors: Maven, PyPI.

Quick answers

Is CVE-2025-55039 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-55039 being exploited in the wild.
How severe is CVE-2025-55039?
Medium severity, with a CVSS score of 6.5, published 15 October 2025.
Which products and versions are affected?
org.apache.spark:spark-network-common_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=3.4.4; org.apache.spark:spark-network-common_2.13 (Maven) ECOSYSTEM:introduced=3.5.0,fixed=3.5.2; pyspark (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.4, ECOSYSTEM:introduced=0,fixed=3.4.4,introduced=3.5.0,fixed=3.5.2.
Is there a fix for CVE-2025-55039?
Yes. org.apache.spark:spark-network-common_2.12 (Maven): upgrade to 3.4.4 or later; org.apache.spark:spark-network-common_2.13 (Maven): upgrade to 3.5.2 or later; pyspark (PyPI): upgrade to 3.4.4, 3.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55039 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-55039?
Check whether you run org.apache.spark:spark-network-common_2.12 (Maven), org.apache.spark:spark-network-common_2.13 (Maven) or pyspark (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.spark:spark-network-common_2.12 (Maven): upgrade to 3.4.4 or later
    # set org.apache.spark:spark-network-common_2.12 to 3.4.4 in your pom.xml or build.gradle
  • org.apache.spark:spark-network-common_2.13 (Maven): upgrade to 3.5.2 or later
    # set org.apache.spark:spark-network-common_2.13 to 3.5.2 in your pom.xml or build.gradle
  • pyspark (PyPI): upgrade to 3.4.4, 3.5.2 or later
    pip install "pyspark>=3.5.2"

Technical details

Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0 default to AES in CTR mode (AES/CTR/NoPadding) for RPC communication when 'spark.network.crypto.enabled' is set to true but no specific cipher is configured. AES-CTR provides confidentiality but lacks integrity protection (authentication). A man-in-the-middle attacker can perform bit-flipping attacks on the ciphertext to modify RPC traffic, such as heartbeat messages or application data, without detection. The vulnerability is mitigated by explicitly configuring 'spark.network.crypto.cipher' to 'AES/GCM/NoPadding' or by enabling SSL. Patches are available in versions 3.4.4, 3.5.2, and 4.0.0.

Affected products

  • Apache Spark < 3.4.4, >= 3.5.0, < 3.5.2
  • Apache pyspark < 3.4.4, >= 3.5.0, < 3.5.2

Identifiers

  • CVE-2025-55039
  • GHSA-6p6v-m64v-jx8q
  • PYSEC-2025-184

Timeline

  • 2025-10-14: disclosed: Initial disclosure on oss-security mailing list
  • 2025-10-15: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.