Code Execution Vulnerability in Apache Spark History Server

CVE-2025-54920

What is CVE-2025-54920?

The Spark History Server in Apache Spark versions prior to 3.5.7 and 4.0.1 is susceptible to a code execution vulnerability due to overly permissive Jackson deserialization of event log data. Attackers with access to the event logs directory can inject malicious JSON payloads into the event log files. This exploitation allows deserialization of arbitrary classes, potentially leading to unauthorized command execution on the server where the History Server operates. To mitigate this risk, it is crucial for users to upgrade to version 3.5.7 or 4.0.1 and above, which incorporate necessary security enhancements.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References