Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks

Vulnerability

Overview

CVE-2025-55039 affects Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0. When the optional RPC encryption feature is enabled (spark.network.crypto.enabled=true) but the cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding) [1][3]. This mode provides encryption without authentication, meaning the ciphertext can be modified by an attacker without detection.

Exploitation

A man-in-the-middle attacker positioned between Spark nodes can flip bits in the encrypted RPC traffic. Because CTR mode lacks integrity checks, the attacker can alter heartbeat messages or application data without the communicating parties noticing [1][3]. The attack requires the attacker to have network access to intercept and modify traffic, but does not require authentication credentials.

Impact

Successful exploitation compromises the integrity of Spark workflows. An attacker could manipulate data being exchanged between nodes, potentially leading to incorrect computation results, altered job behavior, or disruption of cluster operations [1]. The confidentiality of the traffic remains protected, but integrity is lost integrity can have serious consequences for data processing pipelines.

Mitigation

Users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption, or enable SSL encryption by setting spark.ssl.enabled to true for stronger transport security [1][3]. Patched versions (3.4.4, 3.5.2, 4, 4.0.0) are available from the recommended fix.