https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T15:50:26.251502+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-spark-2021-38296 BIT-spark-2021-38296 — Apache Spark Key Negotiation Vulnerability 2026-10-08T15:50:26.259887+00:00

Affected: Bitnami: spark

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-08T15:50:26.259944+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cnvd-2022-21823 cnvd-2022-21823 2026-10-08T15:50:26.259964+00:00 cnvd-2022-21823 https://cve.radiocsirt.org/vuln/euvd-2026-30215 EUVD-2026-30215 2026-10-08T15:50:26.259977+00:00 EUVD-2026-30215 https://cve.radiocsirt.org/vuln/fkie_cve-2021-38296 fkie_cve-2021-38296 2026-10-08T15:50:26.259987+00:00

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

 https://cve.radiocsirt.org/vuln/ghsa-9rr6-jpg7-9jg6 GHSA-9rr6-jpg7-9jg6 — Authentication Bypass by Capture-replay in Apache Spark 2026-10-08T15:50:26.260012+00:00

Affected: Maven: org.apache.spark:spark-core, PyPI: pyspark

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

 https://cve.radiocsirt.org/vuln/gsd-2021-38296 gsd-2021-38296 2026-10-08T15:50:26.260037+00:00 gsd-2021-38296 https://cve.radiocsirt.org/vuln/oesa-2022-1591 OESA-2022-1591 — spark security update 2026-10-08T15:50:26.260048+00:00

Affected: openEuler:20.03-LTS-SP1: spark, openEuler:20.03-LTS-SP2: spark, openEuler:20.03-LTS-SP3: spark

Apache Spark achieves high performance for both batch and streaming data, using a state-of-the-art DAG scheduler, a query optimizer, and a physical execution engine. Security Fix(es): Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later(CVE-2021-38296)

 https://cve.radiocsirt.org/vuln/pysec-2022-186 PYSEC-2022-186 2026-10-08T15:50:26.260075+00:00

Affected: PyPI: pyspark

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later