Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-30065US | critical9.8 | Exploit | ||
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/04/01/1WEB
- https://access.redhat.com/security/cve/CVE-2025-30065WEB
- https://github.com/apache/parquet-javaPACKAGE
- https://github.com/apache/parquet-java/issues/3168WEB
- https://github.com/apache/parquet-java/pull/3169WEB
- https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.javaWEB
- https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.javaWEB
- https://issues.apache.org/jira/browse/AVRO-3985WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan