Paper/Archive/CVE-2025-30065

CVE-2025-30065

Apache Software Foundation Apache Parquet Java — Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

EPSS 44%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 98.7.987 × 2019.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Parquet Java≤ 1.15.0–CNA

Scores by source

apache (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5 exploitgithub.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java exploitgithub.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java refopenwall.com/lists/oss-security/2025/04/01/1 refnews.ycombinator.com/item?id=43603091 refbleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet refaccess.redhat.com/security/cve/CVE-2025-30065 refgithub.com/apache/parquet-java/pull/3169