CRITICAL
GHSA-2c59-37c4-qrx5
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Quick fix
GHSA-2c59-37c4-qrx5 — org.apache.parquet:parquet-avro: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.15.1</version> for org.apache.parquet:parquet-avroDetails
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.parquet:parquet-avro
Introduced in:
0Fixed in: 1.15.1Fix
# pom.xml: bump <version>1.15.1</version> for org.apache.parquet:parquet-avroReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-30065[ADVISORY]
- https://github.com/apache/parquet-java/issues/3168[WEB]
- https://github.com/apache/parquet-java/pull/3169[WEB]
- https://access.redhat.com/security/cve/CVE-2025-30065[WEB]
- https://github.com/apache/parquet-java[PACKAGE]
- https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java[WEB]
- https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java[WEB]
- https://issues.apache.org/jira/browse/AVRO-3985[WEB]
- https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5[WEB]
- https://news.ycombinator.com/item?id=43603091[WEB]
- https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet[WEB]
- http://www.openwall.com/lists/oss-security/2025/04/01/1[WEB]