Package
spark-4.2-scala-2.13
Component
jline-remote-telnet
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Vulnerable classes are shaded/relocated inside Apache Hadoop's pre-built hadoop-client-runtime uber-jar. Spark POM property overrides only affect the standalone jars Spark resolves — they can't rewrite classes already shaded into a third-party artifact. As of 2026-08-04 this cannot be fixed in the Spark build: hadoop.version is already 3.5.0, the newest hadoop-client-runtime on Maven Central (latest and release both 3.5.0, no 4.x, per https://repo.maven.apache.org/maven2/org/apache/hadoop/hadoop-client-runtime/maven-metadata.xml). Verified against the embedded pom.properties in hadoop-client-runtime-3.5.0.jar (commons-configuration2 2.10.1, jackson-core/databind 2.18.6, jetty-http 9.4.58.v20250814, jline-remote-telnet 3.9.0). Remediation requires Hadoop to publish a re-shaded release and Spark to adopt it. Re-check the Maven Central link above when re-triaging, as this may goes stale once Hadoop ships a newer release.
Status