From a technical perspective, CVE-2025-30065 is a deserialization flaw in the parquet-avro module of Apache Parquet Java, where the library fails to restrict which Java classes can be instantiated when reading Avro data embedded in Parquet files. A proof-of-concept exploit has been publicly released for a maximum severity Apache Parquet vulnerability, tracked as CVE-2025-30065, making it easy to find vulnerable servers. On April 2, 2025, Endor Labs published a write-up warning about the risk of exploitation and its potential impact on systems that import Parquet files from external points. Besides using the tool, it is recommended to upgrade to Apache Parquet version 15.1.1 or later, and configure 'org.apache.parquet.avro.SERIALIZABLE_PACKAGES' to restrict which packages are allowed for deserialization. Apache Parquet is an open-source, columnar storage format designed for efficient data processing, widely used by big data platforms and organizations engaged in data engineering and analytics. Subsequent analysis by F5 Labs shows that the flaw is not a full deserialization RCE but can still be misused if a class has side effects during instantiation, like when making a network request from the vulnerable system to an attacker-controlled server. Despite the low likelihood of exploitation, the researchers admit that some organizations process Parquet files from external, often unverified sources, and hence the risk is significant in some environments. For this reason, F5 Labs created a "canary exploit" tool (available on GitHub) that triggers an HTTP GET request via instantiation of javax.swing.JEditorKit, allowing users to verify exposure. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. "While Parquet and Avro are used widely, this issue requires a specific set of circumstances that isn't all that likely in general," reads the F5 Labs report.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 06 May 2025 18:20:04 +0000