Apache Parquet Java vulnerabilities

2 known vulnerabilities in Apache Parquet Java from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache Parquet Java: External Control of File Name or Path

  CVE-2025-46762May 6, 2025ApacheEPSS 1.62%

  Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious c

• 9.8 Critical severity

  Apache Parquet Java: Deserialization of Untrusted Data

  CVE-2025-30065Apr 1, 2025ApacheEPSS 43.6%

  Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.