How severe is CVE-2018-11804?

CVE-2018-11804 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2018-11804 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-11804?

CVE-2018-11804 affects Apache Spark. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-11804?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-11804 published?

CVE-2018-11804 was published on 2018-10-24 and last updated on 2026-06-17.

CVE-2018-11804

CVE-2018-11804 is a high-severity vulnerability in Apache Spark with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 6% (92nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Apache Spark
Published: 2018-10-24
Last modified: 2026-06-17

Description

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.

Frequently asked questions

What is CVE-2018-11804?: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.
How severe is CVE-2018-11804?: CVE-2018-11804 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2018-11804 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-11804?: CVE-2018-11804 affects Apache Spark. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-11804?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-11804 published?: CVE-2018-11804 was published on 2018-10-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Spark

CVE-2020-9480 — Critical (CVSS 9.8): In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…
CVE-2018-17190 — Critical (CVSS 9.8): In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then…
CVE-2019-20445 — Critical (CVSS 9.1): HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second…
CVE-2025-54920 — High (CVSS 8.8): This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and…
CVE-2023-32007 — High (CVSS 8.8): ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option…
CVE-2022-33891 — High (CVSS 8.8): The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an…

All CVEs affecting Apache Spark →