Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• osv-coords5 versions

  pkg:apk/chainguard/druidpkg:apk/chainguard/druid-compatpkg:apk/wolfi/druidpkg:apk/wolfi/druid-compatpkg:maven/org.apache.parquet/parquet-avro

  < 32.0.1-r2+ 4 more

  • (no CPE)range: < 32.0.1-r2
  • (no CPE)range: < 32.0.1-r2
  • (no CPE)range: < 32.0.1-r2
  • (no CPE)range: < 32.0.1-r2
  • (no CPE)range: < 1.15.1
• Apache Software Foundation/Apache Parquet Javav5

  Range: 0

• github.com/advisories/GHSA-2c59-37c4-qrx5ghsaADVISORY
• lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5ghsavendor-advisoryWEB
• nvd.nist.gov/vuln/detail/CVE-2025-30065ghsaADVISORY
• www.openwall.com/lists/oss-security/2025/04/01/1ghsaWEB
• access.redhat.com/security/cve/CVE-2025-30065ghsaWEB
• github.com/apache/parquet-java/issues/3168ghsaWEB
• github.com/apache/parquet-java/pull/3169ghsaWEB
• github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.javaghsaWEB
• github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.javaghsaWEB
• issues.apache.org/jira/browse/AVRO-3985ghsaWEB
• news.ycombinator.com/itemghsaWEB
• www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquetghsaWEB

No linked articles in our index yet.