high8.7
CVE-2025-54981
Apache StreamPark uses a Weak Encryption Algorithm
Impact
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.streampark:streampark | >= 2.0.0, < 2.1.7 | 2.1.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Streampark | from 2.0.0 before 2.1.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.apache.org/thread/9rbvdvwg5fdhzjdgyrholgso53r26998
- http://www.openwall.com/lists/oss-security/2025/12/12/4
- https://github.com/advisories/GHSA-749j-2hp6-8cxm
- https://nvd.nist.gov/vuln/detail/CVE-2025-54981
- https://github.com/apache/streampark/commit/39034db0c806168afa82e58e4f376e1e3c3b73e4