GHSA-2c59-37c4-qrx5

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-30065

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.parquet:parquet-avro	< 1.15.1	1.15.1

Details

As written in the advisory (Markdown source, shown as plain text).

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-30065 advisory
https://github.com/apache/parquet-java/issues/3168 web
https://github.com/apache/parquet-java/pull/3169 web
https://access.redhat.com/security/cve/CVE-2025-30065 web
https://github.com/apache/parquet-java package
https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java web
https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java web
https://issues.apache.org/jira/browse/AVRO-3985 web
https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5 web
https://news.ycombinator.com/item?id=43603091 web
https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet web
http://www.openwall.com/lists/oss-security/2025/04/01/1 web