CVE-2025-54981

Dec. 15, 2025, 5:19 p.m.

7.5
High

Description

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Product(s) Impacted

Vendor Product Versions
Apache
  • Streampark
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a apache streampark / / / / / / / /

References

https://lists.apache.org/thread/9rbvdvwg5fdhzjdgyrholgso53r26998
http://www.openwall.com/lists/oss-security/2025/12/12/4

Tags

security@apache.org
2025-12-12
CVE-2025-54981

CVSS Score

7.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: Dec. 12, 2025, 3:15 p.m.
Last Modified: Dec. 15, 2025, 5:19 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

security@apache.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.