Open-source package vulnerability · Maven
CVE-2025-30065: Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
criticalCVSS 4.0 10.0GHSA-2c59-37c4-qrx5
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Published Apr 1, 2025 · Updated May 7, 2025
Affected packages
org.apache.parquet:parquet-avro
- Ecosystem
- Maven
- Affected
- < 1.15.1
- Fixed in
- 1.15.1
- Check
mvn dependency:tree -Dincludes=org.apache.parquet:parquet-avro
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-30065
- https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
- https://github.com/apache/parquet-java/issues/3168
- https://github.com/apache/parquet-java/pull/3169
- https://issues.apache.org/jira/browse/AVRO-3985
- https://access.redhat.com/security/cve/CVE-2025-30065
- https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java
- https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java
- https://news.ycombinator.com/item?id=43603091
- https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet
- https://github.com/advisories/GHSA-2c59-37c4-qrx5
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology