The fault lies in the Spark History Server’s handling of event log JSON prior to Spark 3.5.7 and 4.0.1, where Jackson’s polymorphic deserialization accepts a class name supplied in the JSON. An attacker who can write to the event log directory can craft a payload that lists an arbitrary class, such as org.apache.hive.jdbc.HiveConnection, and trigger the History Server to instantiate it during deserialization. This permits arbitrary code execution on the host running the History Server, giving the attacker full control of the system.

Apache Software Foundation’s Apache Spark is affected for all releases older than 3.5.7 and 4.0.1, including 3.5.4 and the 4.0.0 release candidates documented by the CPE list. Users running those versions should verify that the event log location is not writable by untrusted parties.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is below 1%, marking a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog, so no confirmed exploits are publicly known. However, exploitation requires write access to the event log directory, which is a local privilege condition. Once the malicious JSON is processed, the attacker achieves full code execution on the host running the History Server, posing a significant system‐wide threat.