PT-2025-14089 · Apache · Apache Parquet

Keyi Li · Published 2025-03-17 · Updated 2025-08-31 · CVE-2025-30065

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.15.0 and previous versions

Description A critical vulnerability in the Apache Parquet Java library allows attackers to execute arbitrary code on systems reading Parquet files. The vulnerability is caused by a deserialization flaw in the parquet-avro module, which can be exploited by sending malicious data files. This flaw affects any application that processes Parquet files, especially when sourced from external or untrusted origins. The issue allows attackers to execute remote code, potentially leading to the execution of malware, theft of data, or operational disruptions.

Recommendations To resolve the issue, upgrade to Apache Parquet version 1.15.1 or later, which fixes the vulnerability. Additionally, implement stringent monitoring to detect any unusual activities and avoid processing Parquet files from dubious sources. Configure org.apache.parquet.avro.SERIALIZABLE PACKAGES to limit the packages allowed for deserialization. As a temporary workaround, consider restricting access to the parquet-avro module until a patch is available.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-03991

CVE-2025-30065

GHSA-2C59-37C4-QRX5

Affected Products

Apache Parquet

References · 123

• 🔥 https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java · Exploit
• 🔥 https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java · Exploit
• 🔥 https://bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet · Exploit
• 🔥 https://github.com/ron-imperva/CVE-2025-30065-PoC · Exploit
• https://github.com/apache/parquet-java/pull/3169 · Patch
• https://osv.dev/vulnerability/CVE-2025-30065 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c59-37c4-qrx5 · Vendor Advisory
• https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-30065 · Security Note
• https://github.com/apache/parquet-java · Note
• https://github.com/apache/parquet-java/issues/3168 · Note
• https://twitter.com/troyCyber_/status/1908570544150053241 · Twitter Post
• https://twitter.com/manuelbissey/status/1908143779858546957 · Twitter Post
• https://twitter.com/CCBalert/status/1920483160292270174 · Twitter Post