Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code

Apache Tomcat is affected by a path equivalence flaw (CWE-44) in its handling of partial PUT requests, compounded by deserialization of untrusted data (CWE-502). A remote attacker triggers it by sending a crafted partial PUT (a PUT request with a Content-Range header) to a Tomcat instance that has write access enabled on its default servlet, causing uploaded content to be placed or reconstructed incorrectly and potentially leading to deserialization of attacker-controlled data. Successful exploitation can yield remote code execution, disclosure of sensitive information, or injection of malicious content, and CISA notes the flaw can be chained with CVE-2026-34486. Any organization running Apache Tomcat is potentially affected (version ranges were not specified in the provided data), with risk concentrated in deployments that permit PUT uploads and use file-based session persistence in default locations. Exploitation is confirmed in the wild: the CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-01 and EPSS assigns a 99.9% probability of exploitation within 30 days, though no public proof-of-concept is known.

Do: Apply the vendor mitigation per CISA's required action: upgrade Tomcat to the fixed release identified in Apache's security advisory for this CVE, or, if patching is not immediately possible, disable write access (readonly) on the default servlet/restrict partial PUT and move file-based session storage away from default locations. Federal agencies must follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Audit Tomcat instances (including embedded deployments) for write-enabled PUT and file-based session persistence, and consider exposure to chaining with CVE-2026-34486.

The parquet-avro module of Apache Parquet Java, versions 1.15.0 and all earlier versions, contains a flaw (CWE-502, deserialization of untrusted data) in how it parses Avro schemas embedded in Parquet files, which allows arbitrary code execution. It is triggered when a vulnerable application reads a Parquet file whose embedded Avro schema is attacker-controlled, for example a file uploaded to a data pipeline or fetched from partially trusted storage. An attacker gains arbitrary code execution in the context of the process reading the file, with high impact on confidentiality, integrity and availability (CVSS 4.0 base score of 10.0, no privileges or user interaction required). Any application or data platform using parquet-avro through 1.15.0 to ingest Parquet files is affected, including big-data frameworks and custom ETL jobs that bundle the Java library. There is no confirmed in-the-wild exploitation yet (not in CISA KEV), but a public proof of concept exists, public scanning/exploit tooling has been released, and EPSS assigns a 43.6% probability of exploitation within 30 days (99th percentile).

Do: Upgrade the parquet-avro dependency (and any bundled Parquet Java library) to version 1.15.1 immediately, including in Spark, Hive, Flink, Kafka Connect and custom ETL images that pull it in transitively. Until patched, only parse Parquet files from fully trusted sources and review whether externally supplied or user-uploaded Parquet files reach vulnerable code paths. Audit dependency trees for parquet-avro versions 1.15.0 or earlier and use the publicly released scanning tooling to locate affected servers.