CVE-2025-54981 Apache StreamPark: Weak Encryption Algorithm in StreamPark

What is CVE-2025-54981?

CVE-2025-54981 is a high-severity vulnerability in Apache StreamPark, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have risked exposing sensitive authentication data

This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.

Users are recommended to upgrade to version 2.1.7, which fixes the issue.

Weakness: CWE-327

Which versions are affected by CVE-2025-54981?

2 open source packages ship an affected version, including org.apache.streampark:streampark. It affects 1 product.

Products include Apache Streampark.

How do I fix CVE-2025-54981?

Upgrade org.apache.streampark:streampark to 2.1.7 or later.

Is CVE-2025-54981 being exploited?

There is no known exploitation of CVE-2025-54981 in the wild and no public exploit code.

Other vulnerabilities in Apache StreamPark

• CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory Critical 9.8
• CVE-2024-29070 Apache StreamPark: session not invalidated after logout Critical 9.1
• CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset Critical 9.1
• CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability High 8.8
• CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-749j-2hp6-8cxm.