An attacker who can write to a Spark event log directory can inject JSON payloads that trigger Jackson’s polymorphic deserialization of SparkListenerEvent objects. Because the deserializer accepts a fully‑qualified class name supplied in the JSON, the History Server can instantiate arbitrary Java classes, such as org.apache.hive.jdbc.HiveConnection, during event log processing. This flaw can be leveraged to execute arbitrary code on the machine running the History Server, giving the attacker full control over that host.

All Apache Spark releases older than 3.5.7 and 4.0.1, including 3.5.4 and the 4.0.0 release candidates listed in the CPE entries, are affected. The vulnerability is present only when the History Server scans event logs located in a writable directory.

The CVSS score of 8.8 indicates high severity, while the EPSS score of 5% reflects a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits are publicly documented. While the CVE description indicates that malicious JSON payloads can be processed by the History Server, it does not explicitly state the exact environmental or access prerequisites required for exploitation; the implied need to inject payloads into event log files is inferred from the attack description.