CVE-2025-30065

The parquet-avro module of Apache Parquet Java, versions 1.15.0 and all earlier versions, contains a flaw (CWE-502, deserialization of untrusted data) in how it parses Avro schemas embedded in Parquet files, which allows arbitrary code execution. It is triggered when a vulnerable application reads a Parquet file whose embedded Avro schema is attacker-controlled, for example a file uploaded to a data pipeline or fetched from partially trusted storage. An attacker gains arbitrary code execution in the context of the process reading the file, with high impact on confidentiality, integrity and availability (CVSS 4.0 base score of 10.0, no privileges or user interaction required). Any application or data platform using parquet-avro through 1.15.0 to ingest Parquet files is affected, including big-data frameworks and custom ETL jobs that bundle the Java library. There is no confirmed in-the-wild exploitation yet (not in CISA KEV), but a public proof of concept exists, public scanning/exploit tooling has been released, and EPSS assigns a 43.6% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade the parquet-avro dependency (and any bundled Parquet Java library) to version 1.15.1 immediately, including in Spark, Hive, Flink, Kafka Connect and custom ETL images that pull it in transitively. Until patched, only parse Parquet files from fully trusted sources and review whether externally supplied or user-uploaded Parquet files reach vulnerable code paths. Audit dependency trees for parquet-avro versions 1.15.0 or earlier and use the publicly released scanning tooling to locate affected servers.