CVE-2025-30065

Published Apr 1, 2025

Last updated 10 months ago

CVSS critical 10.0

Apache Parquet

Java

AWS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-30065 is a vulnerability in the Apache Parquet Java library, specifically within the parquet-avro module. It stems from insecure deserialization of untrusted data during schema parsing. This flaw affects Apache Parquet versions up to and including 1.15.0. Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution (RCE) on a vulnerable system. This can occur if a system is tricked into reading a specially crafted Parquet file. It is recommended to upgrade to version 1.15.1, which addresses the issue.

Description: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Source: security@apache.org
NVD status: Analyzed
Products: parquet_java

Risk scores

CVSS 4.0

Type: Secondary
Base score: 10
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:parquet_java:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EC4B22E1-F482-470E-B3D5-12D6E8C4DF0F",
            "versionEndExcluding": "1.15.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.