Apache Spark CVE-2025-55039

Exploitation requires ALL of: (1) a network-level man-in-the-middle position on RPC traffic between Spark nodes; (2) the non-default setting spark.network.crypto.enabled=true (disabled by default); and (3) spark.network.crypto.cipher left unconfigured so Spark falls back to unauthenticated AES/CTR/NoPadding. It does NOT apply to default deployments (crypto disabled), to clusters that set spark.network.crypto.cipher=AES/GCM/NoPadding, or to clusters using spark.ssl.enabled=true. The requirement for an active MitM position plus an opt-in encryption configuration are the key limiting factors that make real-world exploitation narrow and targeted rather than broad.

This is a genuine but low-priority integrity weakness rather than a high-urgency flaw. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) suggests easy network exploitation, but this understates the real barriers: exploitation requires a man-in-the-middle position on inter-node RPC traffic AND a non-default victim configuration (spark.network.crypto.enabled=true with spark.network.crypto.cipher left unset). The MitM requirement realistically raises attack complexity beyond the AC:L the vector claims - I would assess AC:H. EPSS corroborates low real-world risk at 0.24% (13th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. CWE-326 (inadequate encryption strength) and the description both center on INTEGRITY (undetected ciphertext bit-flipping), yet NVD assigned C:L - note this apparent emphasis mismatch: the primary impact is tampering, not disclosure. Net: a real defense-in-depth issue for hardened Spark clusters that opted into RPC encryption, but not a widespread exploitation priority.

An attacker who has gained a man-in-the-middle position on the network between Spark nodes (e.g., on a shared or compromised cluster network segment) intercepts AES/CTR-encrypted RPC traffic. Because CTR mode provides no authentication, the attacker flips targeted bits in the ciphertext to alter heartbeat messages or application data without detection, corrupting the integrity of Spark workflows. No public exploit code is identified, and exploitation is only possible if the cluster enabled RPC encryption without specifying an authenticated cipher.