Cloudanix VulnDB

CVE-2025-55039

None

Apache Spark has Inadequate Encryption Strength

CVSS

—

EPSS

0.2%

Published

Oct 15, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A default setting in older Spark versions lets attackers secretly change information moving between parts of a data processing system without being noticed.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
Application
Class
Cryptographic Weakness
Remediation
Config Change
Effort
Low
Patch risk
None

What it actually does

Insecure default of AES/CTR/NoPadding for RPC encryption when spark.network.crypto.enabled is true but cipher is unset, allowing undetected bit-flipping modifications to ciphertext by a network attacker.

Why it matters to the business

Attackers can silently alter job heartbeats or data exchanged between Spark nodes, potentially corrupting workflow results or causing processing failures in large-scale data environments.

How an attack unfolds

An attacker on the network path between Spark nodes intercepts encrypted RPC traffic, flips selected bits in the ciphertext to alter messages such as heartbeats or task data, and forwards the modified packets without triggering authentication failures due to the lack of integrity protection.

How to fix it

Upgrade Apache Spark to 3.4.4, 3.5.2, or 4.0.0 or later; alternatively set spark.network.crypto.cipher to AES/GCM/NoPadding or enable spark.ssl.enabled=true. For the SUSE package apply the fixed kgraft-patch-SLE12-SP2_Update_4 update. The GIT fix is in commit 6729992c76fc59ab07f63f97a9858691274447d0.

How to confirm the fix worked

Verify Spark version is at or above the fixed releases, confirm spark.network.crypto.cipher is explicitly set to an authenticated mode or that SSL is enabled, and review cluster configuration files for the insecure default.

Typical attack path

  1. Position as network intermediary between Spark cluster nodes
  2. Capture RPC packets when crypto is enabled with default CTR cipher
  3. Perform targeted bit flips on ciphertext to modify heartbeat or application data
  4. Forward altered packets to recipient nodes
  5. Observe or induce workflow integrity failures without detection

How to detect it

Review Spark RPC logs and network traffic captures for unexpected heartbeat failures, task data corruption, or anomalous modification patterns between nodes; correlate with configuration audits showing the vulnerable default cipher.

What your security team should do

  • Immediately upgrade affected Spark installations to the listed fixed versions
  • Audit all clusters for spark.network.crypto.enabled=true without an authenticated cipher setting
  • Prioritize enabling SSL or GCM cipher on any production or sensitive workloads
  • Monitor EPSS trend and re-evaluate if exploit maturity increases

The record

This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.spark:spark-network-common_2.12 0 3.4.4
Maven org.apache.spark:spark-network-common_2.12 3.5.0 3.5.2
Maven org.apache.spark:spark-network-common_2.13 0 3.4.4
Maven org.apache.spark:spark-network-common_2.13 3.5.0 3.5.2
maven org.apache.spark/spark-network-common_2.12 3.5.0 3.5.2
maven org.apache.spark/spark-network-common_2.13 3.5.0 3.5.2

Related vulnerabilities