CVE-2025-55039: Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.
Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.
When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.
This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.
To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or
enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.spark:spark-network-common_2.12to a version that resolves this vulnerability.Fixed in 3.5.2 - Upgrade
Upgrade
maven/org.apache.spark:spark-network-common_2.12to a version that resolves this vulnerability.Fixed in 3.4.4 - Upgrade
Upgrade
maven/org.apache.spark:spark-network-common_2.13to a version that resolves this vulnerability.Fixed in 3.4.4 - Upgrade
Upgrade
maven/org.apache.spark:spark-network-common_2.13to a version that resolves this vulnerability.Fixed in 3.5.2 - Upgrade
Upgrade
Apache Sparkto a version that resolves this vulnerability.Fixed in 3.4.4 - Configuration
Configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption.
Apache Spark RPC encryption spark.network.crypto.cipher = AES/GCM/NoPadding - Configuration
Set spark.ssl.enabled to true to enable SSL encryption for stronger transport security.
Apache Spark SSL encryption spark.ssl.enabled = true
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55039?
CVE-2025-55039 has a high severity due to the use of an insecure default network encryption cipher in affected Apache Spark versions.
How do I fix CVE-2025-55039?
To fix CVE-2025-55039, upgrade Apache Spark to version 4.0.0, 3.5.2, or 3.4.4 or later.
Which versions of Apache Spark are affected by CVE-2025-55039?
CVE-2025-55039 affects Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0.
What is the impact of CVE-2025-55039?
The impact of CVE-2025-55039 includes potential exposure to insecure RPC communications between Spark nodes.
Is spark.network.crypto.enabled enabled by default in Apache Spark prior to version 4.0.0?
No, spark.network.crypto.enabled is set to false by default in versions of Apache Spark prior to 4.0.0.