Synced 02 Nov 2026 13:39 UTC Account

Is Spark 2.3.4 patched?

Apache · cycle 2.3 · end of life
2.3.420/100Critical · exploited

Current stable (4.2.1): 100/100

Minimum safe version3.5.7

2.3.4 has 5 open critical-or-high vulnerabilities. Run 3.5.7 or later to clear them. See what 3.5.7 fixes →

Upgrade impact: Major upgrade. Crossing a major version usually means breaking changes. Review the vendor’s upgrade / migration guide and test before you roll it out.

Health score20/100
Open issues10
Exploited now1
Cycle 2.3 EOL2019-08-25
Latest release4.2.1

Summary iPlain-English security status for Spark 2.3.4, built from its CVEs, active-exploitation data, end-of-life date and latest release.

Spark 2.3.4 is part of the 2.3 release line. 1 actively-exploited vulnerability affects it (CISA KEV). The minimum safe version is 3.5.7 — upgrade to it or later to clear the open critical/high issues. The 2.3 line reached end-of-life on 2019-08-25, so it no longer receives security patches. The latest supported Spark release is 4.2.1.

Known issues affecting 2.3.4

Exploited first, then by exploitation probability.

CVE-2022-33891 HIGH exploited EPSS 93% → see advisory CVE-2023-32007 HIGH EPSS 76% → see advisory CVE-2018-11770 MEDIUM EPSS 66% → fixed in 2.4.0 CVE-2020-9480 CRITICAL EPSS 29% → see advisory CVE-2025-54920 HIGH EPSS 5% → fixed in 3.5.7 CVE-2021-38296 HIGH EPSS 2% → fixed in 3.1.3 CVE-2022-31777 MEDIUM EPSS 2% → fixed in 3.2.2 CVE-2024-23945 MEDIUM EPSS 2% → fixed in 3.4.2 CVE-2023-22946 MEDIUM EPSS 1% → fixed in 3.4.0 CVE-2025-55039 MEDIUM EPSS 0% → fixed in 3.5.2

Other Spark versions

Check another release line of Spark.

Spark 4.2.1Spark 4.1.4Spark 4.0.5Spark 3.5.9Spark 3.4.4Spark 3.3.4Spark 3.2.4Spark 3.1.3Spark 3.0.3Spark 2.4.8Spark 2.2.3Spark 2.1.3Spark 2.0.2Spark 1.6.3Spark 1.5.2Spark 1.4.1Spark 1.3.1Spark 1.2.2Spark 1.1.1Spark 1.0.2

Frequently asked

Is Spark 2.3.4 patched?

No — 1 actively-exploited vulnerability affects Spark 2.3.4. Upgrade to at least 3.5.7.

What version should I upgrade Spark 2.3.4 to?

Upgrade Spark 2.3.4 to at least 3.5.7 to clear its 5 open critical-or-high vulnerabilities.

When does Spark 2.3 reach end-of-life?

Spark 2.3 reached end-of-life on 2019-08-25 and no longer receives security patches.

What is the latest version of Spark?

The latest supported Spark release is 4.2.1.

Is Spark 2.3.4 still receiving security updates?

No — Spark 2.3.4 is on the 2.3 line, which reached end-of-life on 2019-08-25 and no longer receives security updates. Upgrade to 4.2.1 or later to stay supported.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade.