CVE-2025-54920 - Vulnerability Analysis

Overview

Apache Spark < 3.5.7 and < 4.0.1 contains a remote code execution vulnerability caused by overly permissive Jackson deserialization of event log data in the Spark History Web UI, letting attackers with write access to event logs execute arbitrary code on the History Server host.

Severity & Score

Impact

Attackers with write access to event logs can execute arbitrary code on the server running the Spark History Server, potentially compromising the entire system.

Mitigation

Upgrade to Apache Spark version 3.5.7, 4.0.1 or later.

References

• https://github.com/apache/spark/pull/51312
• https://github.com/apache/spark/pull/51323
• https://issues.apache.org/jira/browse/SPARK-52381
• https://lists.apache.org/thread/4y9n0nfj7m68o2hpmoxgc0y7dm1lo02s
• http://www.openwall.com/lists/oss-security/2026/03/13/4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner