A most severity distant code execution (RCE) vulnerability has been found impacting all variations of Apache Parquet as much as and together with 1.15.0.
The issue stems from the deserialization of untrusted information that might enable attackers with specifically crafted Parquet recordsdata to realize management of goal programs, exfiltrate or modify information, disrupt providers, or introduce harmful payloads similar to ransomware.
The vulnerability is tracked underneath CVE-2025-30065 and has a CVSS v4 rating of 10.0. The flaw was mounted with the discharge of Apache model 1.15.1.
It ought to be famous that to use this flaw, risk actors should persuade somebody to import a specifically crafted Parquet file.
Extreme risk to “huge information” environments
Apache Parquet is an open-source, columnar storage format designed for environment friendly information processing. Not like row-based codecs (like CSV), Parquet shops information by columns, which makes it quicker and extra space-efficient for analytical workloads.
It’s extensively adopted throughout the information engineering and analytics ecosystem, together with huge information platforms like Hadoop, AWS, Amazon, Google, and Azure cloud providers, information lakes, and ETL instruments.
Some giant corporations that use Parquet embrace Netflix, Uber, Airbnb, and LinkedIn.
The safety downside in Parquet was disclosed on April 1, 2025, following a accountable disclosure by its finder, Amazon researcher Keyi Li.
“Schema parsing within the parquet-avro module of Apache Parquet 1.15.0 and former variations permits dangerous actors to execute arbitrary code,” warned the quick bulletin revealed on Openwall.
“Customers are beneficial to improve to model 1.15.1, which fixes the problem.”
A separate bulletin by Endor Labs highlights the chance of CVE-2025-30065 exploitation extra clearly, warning that the flaw can influence any information pipelines and analytics programs that import Parquet recordsdata, with the chance being important for recordsdata sourced from exterior factors.
Endor Labs believes the issue was launched in Parquet model 1.8.0, although older releases may additionally be impacted. The agency suggests coordinated checks with builders and distributors to find out what Praquet variations are utilized in manufacturing software program stacks.
“If an attacker methods a weak system into studying a specifically crafted Parquet file, they may achieve distant code execution (RCE) on that system,” warns Endor Labs.
Nevertheless, the safety agency avoids over-inflating the chance by together with the observe, “Regardless of the horrifying potential, it is essential to notice that the vulnerability can solely be exploited if a malicious Parquet file is imported.”
That being mentioned, if upgrading to Apache Parquet 1.15.1 instantly is unimaginable, it’s instructed to keep away from untrusted Parquet recordsdata or fastidiously validate their security earlier than processing them. Additionally, monitoring and logging on programs that deal with Parquet processing ought to be elevated.
Though no lively exploitation has been found but, the chance is excessive because of the flaw’s severity and the widespread use of Parquet recordsdata in huge information functions.
Directors of impacted programs are beneficial to improve to Parquet model 1.15.1, which addresses CVE-2025-30065, as quickly as attainable.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and learn how to defend towards them.
