# CVE-2025-55039: Apache Spark Inadequate Encryption Strength in RPC Communication

Source: https://junglewise.ai/threats/cve-2025-55039-apache-spark-inadequate-encryption-strength-in-rpc-communication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-15. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2025-55039 · Severity: medium · CVSS 6.5 · Published 2025-10-15

Apache Spark, a popular data processing engine, uses a weak default encryption method for communication between its internal components when encryption is enabled. This flaw could allow an attacker on the same network to intercept and modify data or system messages without being detected. Such an attack could lead to the corruption of data processing tasks or the disruption of Spark operations.

Technologies: [pyspark (PyPI)](https://junglewise.ai/threats/technologies/pyspark). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-55039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-55039 being exploited in the wild.

**How severe is CVE-2025-55039?** Medium severity, with a CVSS score of 6.5, published 15 October 2025.

**Which products and versions are affected?** org.apache.spark:spark-network-common_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=3.4.4; org.apache.spark:spark-network-common_2.13 (Maven) ECOSYSTEM:introduced=3.5.0,fixed=3.5.2; pyspark (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.4, ECOSYSTEM:introduced=0,fixed=3.4.4,introduced=3.5.0,fixed=3.5.2.

**Is there a fix for CVE-2025-55039?** Yes. org.apache.spark:spark-network-common_2.12 (Maven): upgrade to 3.4.4 or later; org.apache.spark:spark-network-common_2.13 (Maven): upgrade to 3.5.2 or later; pyspark (PyPI): upgrade to 3.4.4, 3.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-55039 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-55039?** Check whether you run org.apache.spark:spark-network-common_2.12 (Maven), org.apache.spark:spark-network-common_2.13 (Maven) or pyspark (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.spark:spark-network-common_2.12 (Maven): upgrade to 3.4.4 or later

  ```sh
  # set org.apache.spark:spark-network-common_2.12 to 3.4.4 in your pom.xml or build.gradle
  ```

- org.apache.spark:spark-network-common_2.13 (Maven): upgrade to 3.5.2 or later

  ```sh
  # set org.apache.spark:spark-network-common_2.13 to 3.5.2 in your pom.xml or build.gradle
  ```

- pyspark (PyPI): upgrade to 3.4.4, 3.5.2 or later

  ```sh
  pip install "pyspark>=3.5.2"
  ```


## Technical details

Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0 default to AES in CTR mode (AES/CTR/NoPadding) for RPC communication when 'spark.network.crypto.enabled' is set to true but no specific cipher is configured. AES-CTR provides confidentiality but lacks integrity protection (authentication). A man-in-the-middle attacker can perform bit-flipping attacks on the ciphertext to modify RPC traffic, such as heartbeat messages or application data, without detection. The vulnerability is mitigated by explicitly configuring 'spark.network.crypto.cipher' to 'AES/GCM/NoPadding' or by enabling SSL. Patches are available in versions 3.4.4, 3.5.2, and 4.0.0.

## Affected products

- Apache Spark < 3.4.4, >= 3.5.0, < 3.5.2
- Apache pyspark < 3.4.4, >= 3.5.0, < 3.5.2

## Identifiers

- CVE-2025-55039
- GHSA-6p6v-m64v-jx8q
- PYSEC-2025-184

## Timeline

- 2025-10-14: disclosed: Initial disclosure on oss-security mailing list
- 2025-10-15: advisory: GitHub Advisory and NVD entry published

## References

- [https://lists.apache.org/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq](https://lists.apache.org/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq)
- [http://www.openwall.com/lists/oss-security/2025/10/14/11](http://www.openwall.com/lists/oss-security/2025/10/14/11)
- [https://github.com/apache/spark/commit/05ba74e5f8043601b7af530429ceaf828d7bb329](https://github.com/apache/spark/commit/05ba74e5f8043601b7af530429ceaf828d7bb329)
- [https://github.com/apache/spark/commit/405b23b1aef889fad03bf4e3ced6d427dc9a43f4](https://github.com/apache/spark/commit/405b23b1aef889fad03bf4e3ced6d427dc9a43f4)
- [https://github.com/apache/spark/commit/f0563ef64c7f42df21b16ccaeb4cf1324ea720f9](https://github.com/apache/spark/commit/f0563ef64c7f42df21b16ccaeb4cf1324ea720f9)

## Related threats

- [Apache Spark History Server XSS in job names](https://junglewise.ai/threats/cve-2026-32773-apache-spark-history-server-xss-in-job-names)
- [Apache Spark UI vulnerable to Command Injection](https://junglewise.ai/threats/cve-2023-32007-apache-spark-ui-vulnerable-to-command-injection)
- [Apache Spark privilege escalation via classpath injection](https://junglewise.ai/threats/cve-2023-22946-apache-spark-privilege-escalation-via-classpath-injection)
- [Apache Spark vulnerable to Log Injection](https://junglewise.ai/threats/cve-2022-31777-apache-spark-vulnerable-to-log-injection)
- [Apache Spark OS command injection in Spark UI via impersonation](https://junglewise.ai/threats/cve-2022-33891-apache-spark-os-command-injection-in-spark-ui-via-impersonation)