While Apache Parquet 1.15.1 introduced a fix to restrict untrusted packages in March 2025, security researchers discovered that the default setting of trusted packages remained permissive, still allowing malicious classes from these packages to be executed. A new critical security vulnerability in Apache Parquet Java has been disclosed that could allow attackers to execute arbitrary code through specially crafted Parquet files. According to the advisory released by Apache Software Foundation, “Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code”. Security experts note this vulnerability follows a similar deserialization flaw (CVE-2025-30065) discovered in April 2025, which also affected the parquet-avro module. The vulnerability was responsibly reported by security researchers Andrew Pikler, David Handermann, and Nándor Kollár, who identified the issue as part of ongoing security research into serialization vulnerabilities. The vulnerability stems from how Avro schemas are handled during deserialization, potentially allowing attackers to inject malicious code that gets executed during schema parsing. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 06:35:02 +0000