CVE-2025-55039

mediumpriority · track · 0EPSS 0.002 · 10 %ileEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (10th) EPSS

CVSS 6.5 · medium

Is it mine?

27 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · ncsc_nl

EPSS · scored 2026-10-27

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondaryexploitability 3.9 · impact 2.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-326USCWE-326USCWE-326USCWE-347US

affected products (27)

Products and version ranges known to be affected.

Apache Software Foundation Apache Spark0 → 3.4.4enisa_euvdEU
Apache Software Foundation Apache Spark3.5.0 → 3.5.2enisa_euvdEU
Oracle Core RDBMS≤ vers:unknown/*ncsc_nlNL
Oracle Essbase≤ vers:unknown/*ncsc_nlNL
Oracle Fleet Patching and Provisioning≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Big Data and Application Adapters≤ vers:unknown/*ncsc_nlNL
Oracle GoldenGate Stream Analytics≤ vers:unknown/*ncsc_nlNL
Oracle GraalVM≤ vers:unknown/*ncsc_nlNL
Oracle Graph Server And Client≤ vers:unknown/*ncsc_nlNL
Oracle Java Virtual Machine≤ vers:unknown/*ncsc_nlNL
Oracle NoSQL Database≤ vers:unknown/*ncsc_nlNL
Oracle Oracle APEX Sample Applications≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Database Server≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Graal Development Kit for Micronaut≤ vers:unknown/*ncsc_nlNL
Oracle Oracle Zero Data Loss Recovery Appliance Software≤ vers:unknown/*ncsc_nlNL
Oracle SQLcl≤ vers:unknown/*ncsc_nlNL
Oracle Secure Backup≤ vers:unknown/*ncsc_nlNL
Oracle Spatial and Graph≤ vers:unknown/*ncsc_nlNL
apache spark< 3.4.4nvdUScpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*

showing 20 of 27

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0021Kwetsbaarheden verholpen in Oracle Database Server productenNL2026-01-21csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Database Server producten.
GHSA-6p6v-m64v-jx8qApache Spark has Inadequate Encryption Strength2025-10-15ghsa · osvUS
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
PYSEC-2025-1842025-10-15vendor · osvUS
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv ncsc_nl nvd NVD CVE.org MITRE

published 2025-10-15modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan