PT-2025-18792 · Apache · Apache Parquet Java

Andrew Pikler + 2 · Published 2025-05-02 · Updated 2025-05-20 · CVE-2025-46762

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Parquet versions prior to 1.15.2

Description The vulnerability in Apache Parquet Java allows remote code execution via insecure parquet-avro module schema parsing. The issue affects versions up to 1.15.1. The parquet-avro module is responsible for processing Avro schemas within the metadata of Parquet files. Despite an earlier update in version 1.15.1 intended to restrict untrusted packages, the default settings remain permissive enough that harmful classes can still be executed. This is particularly worrisome for data processing pipelines that may draw files from untrusted sources, putting any application utilizing this module at risk of remote code execution. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files.

Recommendations Apache Parquet version 1.15.1: Set the system property "org.apache.parquet.avro.SERIALIZABLE PACKAGES" to an empty string. Apache Parquet versions prior to 1.15.1: Upgrade to version 1.15.2. Apache Parquet versions prior to 1.15.2 (general recommendation): Upgrade to version 1.15.2 to ensure safety.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-73

Related Identifiers

BDU:2025-05235

CVE-2025-46762

GHSA-53WX-PR6Q-M3J5

Affected Products

Apache Parquet Java

References · 34

• https://lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05235 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-46762 · Security Note
• https://osv.dev/vulnerability/GHSA-53wx-pr6q-m3j5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46762 · Vendor Advisory
• https://github.com/apache/parquet-java · Note
• https://twitter.com/CVEnew/status/1919683552414679153 · Twitter Post
• https://seclists.org/oss-sec/2025/q2/103 · Note
• http://openwall.com/lists/oss-security/2025/05/02/1 · Note
• https://t.me/cvetracker/23155 · Telegram Post
• https://twitter.com/Hosainfosec/status/1919444628656271500 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1kfg4du/critical_vulnerability_in_apache_parquet_java · Reddit Post
• https://twitter.com/CCBalert/status/1919672295129235756 · Twitter Post
• https://t.me/pentestingnews/60761 · Telegram Post
• https://twitter.com/stephan_fr9324/status/1919322884352172048 · Twitter Post