CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.
Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.
- Affects the keytools package in parquet-java 1.12 through 1.18.0
- Envelope encryption wraps data keys via a KMS
- File-supplied KMS URL is passed to pluggable KmsClient without host validation
- CVEs
- CVE-2026-73334
- Vendors
- Apache Software Foundation
- Products
- Apache Parquet
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73334 | Improper Input Validation in Apache Parquet leaks KMS tokens via file-controlled KMS URL | 8.1 | <1% |
From the original article
Posted by Gidon Gershinsky on Sep 08 Severity: moderate Affected versions: - Apache Parquet Hadoop (org. apache. parquet.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.