PT-2026-37182 · Nuget · Parquetsharp

Curthagenlocher · Published 2026-04-24 · Updated 2026-05-07 · CVE-2026-42241

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ParquetSharp versions 18.1.0 through 23.0.0

Description ParquetSharp is a .NET library used for reading and writing Apache Parquet files. The ReadDecimal() function in DecimalConverter performs a stackalloc operation using a value that can be supplied by an attacker. By declaring a decimal column with an unreasonable width, an attacker can trigger a stack overflow, which may result in a denial of service by taking down the application in a service environment. This issue specifically impacts applications that use the library to read untrusted Parquet files within a network service.

Recommendations Update to version 23.0.0.1.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-42241

GHSA-RRJR-V56M-WW88

Affected Products

Parquetsharp

References · 6

• https://osv.dev/vulnerability/GHSA-rrjr-v56m-ww88 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42241 · Security Note
• https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88 · Note
• https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1 · Note
• https://github.com/G-Research/ParquetSharp · Note
• https://twitter.com/CVEnew/status/2052477938977714684 · Twitter Post