CVE-2025-30065 — Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet f…

Description (CNA)

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Parquet Java	affected 0 through 1.15.0

CWE

CWE-502

References

https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java
https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/04/01/1
https://news.ycombinator.com/item?id=43603091
https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/
https://access.redhat.com/security/cve/CVE-2025-30065
https://github.com/apache/parquet-java/pull/3169