CVE-2025-30065

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30065
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30065.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30065
Aliases
Related
Published
2025-04-01T08:15:15.283Z
Modified
2026-04-10T05:24:39.993669Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code

Users are recommended to upgrade to version 1.15.1, which fixes the issue.

References

Affected packages

Git / github.com/apache/parquet-java

Affected ranges

Type
GIT
Repo
https://github.com/apache/parquet-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c7257b8faff5699e13bbc781679dc03f48c1102a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.15.1"
        }
    ]
}

Affected versions

apache-parquet-1.*
apache-parquet-1.10.0
apache-parquet-1.11.0
apache-parquet-1.11.0-rc6
apache-parquet-1.11.0-rc7
apache-parquet-1.12.0
apache-parquet-1.12.0-rc0
apache-parquet-1.12.0-rc1
apache-parquet-1.12.0-rc2
apache-parquet-1.12.0-rc3
apache-parquet-1.12.0-rc4
apache-parquet-1.15.0
apache-parquet-1.15.0-rc1
apache-parquet-1.15.0-rc2
apache-parquet-1.8.0
apache-parquet-1.8.1
apache-parquet-1.9.0
apache-parquet-mr-1.*
apache-parquet-mr-1.6.0-incubating
parquet-1.*
parquet-1.0.0
parquet-1.0.1
parquet-1.1.0
parquet-1.1.1
parquet-1.2.0
parquet-1.2.1
parquet-1.2.10
parquet-1.2.2
parquet-1.2.3
parquet-1.2.4
parquet-1.2.5
parquet-1.2.6
parquet-1.2.7
parquet-1.2.8
parquet-1.2.9
parquet-1.3.0
parquet-1.3.1
parquet-1.3.2
parquet-1.4.0
parquet-1.4.1
parquet-1.4.2
parquet-1.4.3
parquet-1.5.0
parquet-1.6.0rc1
parquet-1.6.0rc2
parquet-1.6.0rc5
parquet-1.6.0rc6
parquet-1.6.0rc7
parquet-1.8.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30065.json"